Arista warned on 22 October that attackers are exploiting a SQL injection zero-day in VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, tracked as CVE-2026-114625 and rated 9.9. Exploitation needs only network access to the orchestrator's web interface and a valid login at the lowest built-in customer role, Enterprise Read Only; success grants operator privileges, described as a local superuser with full access, and may allow the VCO host itself to be exposed, modified or disrupted. Orchestrators are exposed by default and no VCO setting prevents it. On-premises deployments need VCO 5.2.3.18, 6.1.3.10 or 6.4.2.12, while hosted and dedicated orchestrators have already been patched — and because the fixes sit above the releases that resolved the July and September VCO flaws, instances patched against those remain vulnerable. This is the third VCO flaw reported as exploited since late July and the first requiring authentication; the advisory does not say when attacks began or who was hit.

• Source article

Related Pages

• Arista Discloses A Cvss 10 0 Flaw In On Premises Velocloud Orchestrator And Says — CVE-2026-93952 (September, CVSS 10.0): the second VCO flaw reported as exploited this year; the October fixes sit above the releases that resolved it, so instances patched against it remain vulnerable
• Cisa Adds Active Exploited Arista Velocloud And Fortinet Fortios Flaws To Kev Ca — CISA KEV addition covering the VeloCloud and FortiOS flaws