Science & Tech · Cybersecurity · 1 hr ago
Arista patches exploited VeloCloud Orchestrator security flaw
Arista Networks patched an actively exploited security flaw in its on-premises VeloCloud Orchestrator software.
The flaw is in a web-based portal administrators use to manage VeloCloud SD-WAN networks and related devices.
Users with basic access and valid accounts could exploit it through a type of database attack to gain superuser-level privileges.
That could expose or alter the system and the data it manages.
Arista urged customers to install the available updates for affected software versions.
Until they do, the company recommends limiting portal access to administrative networks, checking logs and blocking two IP addresses linked to attacks.
If a customer suspects a breach, Arista advises preserving system records and contacting its technical support team.
Arista Networks released security updates for an actively exploited zero-day vulnerability in on-premises VeloCloud Orchestrator deployments.
The flaw, tracked as CVE-2026-114625, can let an authenticated user with a basic account gain operator or local superuser privileges.
Arista said the issue could expose or affect the orchestrator and the data it manages.
Fixes are available in versions 5.2.3.18, 6.1.3.10 and 6.4.2.12, with later versions also fixed.
Until updates are installed, Arista advises restricting web access, checking logs and blocking two IP addresses linked to attacks.
- Who
- Arista Networks issued the updates; attackers have exploited the flaw.
- What
- A zero-day SQL injection flaw in VeloCloud Orchestrator can let an authenticated user gain elevated privileges.
- When
- Arista announced the issue and fixes on October 22, 2026; the sources do not state when attacks began.
- Where
- On-premises VeloCloud Orchestrator deployments.
- Why
- The flaw allows a logged-in user with basic privileges to access higher-level functions and potentially affect the orchestrator and its managed data.
This story does not have two clearly opposing sides.
Arista patched an actively exploited zero-day, CVE-2026-7473, according to BleepingComputer.
Arista patched another exploited zero-day, CVE-2026-16812, according to BleepingComputer.
Arista patched an exploited VeloCloud Orchestrator flaw, CVE-2026-93952.
Arista disclosed CVE-2026-114625 and issued fixes for affected on-premises releases.
- Vulnerability
- CVE-2026-114625
- Affected product
- VeloCloud Orchestrator on-premises deployments
- Fixed versions
- 5.2.3.18, 6.1.3.10 and 6.4.2.12, plus later versions
- Severity score
- 9.9 on the CVSS scale, according to The Hacker News
- IP addresses linked to attacks
- 74.82.197.86 and 38.54.50.151
3 sources
What people are saying
On an affected system, any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user.
Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible.