Network solutions provider Arista Networks on Thursday released patches for zero-day vulnerabilities exploited in its centralized management tool VeloCloud Orchestrator (VCO).
The critical security flaw is tracked as CVE-2026-114625 (CVSS score of 9.9) and is described as remote SQL injection.
“VeloCloud Orchestrator (VCO) on-prem has a security issue that could allow a remote attacker to access privileged internal functions and affect the VCO host,” Arista noted in it. Consultant.
Successful mining can affect the confidentiality, integrity, and availability of both the VCO and the data it manages.
“On the affected system, authenticated users can gain operator privileges and impersonate the local ‘superuser operator’ user. This includes accessing functions intended for internal use only and not intended for remote access,” the company said.
All VCO releases prior to versions 5.2.3.18, 6.1.3.10 and 6.4.2.12 are affected. Arista has already updated the hosted VCO installation, but urges users to update their on-site installation as soon as possible.
“This issue was discovered by Arista and is known to be actively exploited,” the company said.
Arista notes that VCO installations are exposed by default, and attackers need access to the VCO web interface and an authenticated session, with the lowest possible tenant role privileges.
“There are no settings that can prevent exposure,” the company notes.
The attack was observed from two IP addresses, 74.82.197.86 and 38.54.50.151. Administrators should block them, check their presence logs, and investigate high request rates, as well as requests with unusual URL path components, encoded characters, and references to local or internal services.
“If a compromise is suspected, operators should maintain VCO web access logs, backend application logs, system logs, database logs, and related file system time prior to remediation where possible operations,” Arista noted.
Updating to a fixed VCO release is the recommended corrective action. Until a fix is implemented, administrators should restrict access to the VCO interface, review past admin activity, monitor suspicious access, block outgoing ports, and monitor backdoor daemons and webshells.
CVE-2026-114625 is the third Arista vulnerability patch in VCO in four months, following CVE-2026-16812 in July and CVE-2026-93952 in September.
Related: Atlassian Patches 75 Defects in Data Center and Server Products
Related: Signal Vulnerability Allows Malicious Callers to Interrupt Hang-Ups
Related: Splunk, SolarWinds Release Fresh Security Updates
Related: Cisco Patches 34 Vulnerabilities Across Multiple Products
