Arista Patches Exploited VeloCloud Orchestrator Zero-Day
Arista Networks has rolled out urgent security updates to address a critical, actively exploited zero-day vulnerability affecting on-premises VeloCloud Orchestrator deployments.
Radwan AbdulhadiEditor and technology writer
Overview of the Critical Vulnerability
Arista Networks has released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments, according to a security advisory published by the company. As reported by <a href="https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/">BleepingComputer</a>, VCO serves as a web-based management portal designed to help administrators configure, monitor, and manage VeloCloud SD-WANs and associated edge devices.
The vulnerability has been tracked as <a href="https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199">CVE-2026-114625</a>. This critical-severity flaw permits attackers who possess basic privileges, access to the VCO web interface, and a valid authenticated session to escalate their privileges through low-complexity SQL injection attacks that do not require any user interaction.
Potential Impact and Exploitation Details
Detailed information regarding the nature of the issue was outlined by the vendor. <a href="https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199">Arista said</a> that VeloCloud Orchestrator on-prem has a security issue where a remote attacker could access privileged internal functionality and directly impact the VCO host.
Successful exploitation of this vulnerability may completely compromise the confidentiality, integrity, and availability of both the orchestrator itself and the data managed by the system. On an affected system, any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user, gaining access to functionality intended strictly for internal use and not meant to be remotely accessible.
Patched Versions and Immediate Mitigations
The company has confirmed that it already patched hosted VCO deployments running version 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later. Until patches can be fully deployed across all environments, Arista strongly advises network administrators to actively monitor for connections originating from known malicious IP addresses.
Administrators are also urged to restrict access to the VCO web interface exclusively to administrative networks and thoroughly review recent administrator activity for any unusual changes. Security teams should additionally review VCO web access logs for suspicious activity, such as requests containing unusual URL-like path components, encoded characters, references to local or internal services, and abnormally high request rates.
Indicators of Compromise and Incident Response
As part of the ongoing investigation into these attacks, the company warned security teams to immediately block the 74[.]82.197.86 and 38[.]54.50.151 IP addresses, which have been directly observed during ongoing threat campaigns.
If a compromise is suspected, operators are instructed to preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps prior to initiating any remediation steps where operationally feasible. Customers facing difficulties are advised to contact the Arista Networks Technical Assistance Center for additional guidance and support.
Broader Context and Prior Vulnerabilities
This incident follows a series of similar security events impacting the corporation's product ecosystem. Throughout the year, Arista has patched three other actively exploited zero-day flaws, including <a href="https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137">CVE-2026-7473</a> in May, alongside other vulnerabilities affecting both its Extensible Operating System and on-premises VeloCloud Orchestrator deployments.
Arista Networks is recognized as a Fortune 500 company and ranks among the largest corporations by revenue in the United States, supporting a global customer base exceeding 10,000 organizations worldwide.
Sources
- BleepingComputerArista patches new VeloCloud Orchestrator zero-day exploited in attacks
Continue chronologically
Related stories
Citrix Patches NetScaler SAML Zero-Day Exploited in Attacks
Citrix has released emergency updates for a new NetScaler SAML denial-of-service zero-day vulnerability tracked as CVE-2026-88779.
Palo Alto Networks Warns of Exploited PAN-OS RCE Zero-Day
Palo Alto Networks releases security updates addressing a high-severity PAN-OS remote code execution zero-day flaw actively targeted in attacks.
Apple Backports CoreGraphics Zero-Day Patches to Older Devices
Apple has backported security patches for a CoreGraphics zero-day vulnerability to older iPhone and iPad models following targeted attacks.
Cisco Patches Actively Exploited SD-WAN Zero-Day Flaw
Cisco has released urgent patches for a critical zero-day authentication bypass vulnerability in Catalyst SD-WAN Manager actively exploited in the wild.
