Arista patches VeloCloud zero-day exploited in attacks
Original title: Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
CVE-2026-114625 SQL injection flaw in VeloCloud Orchestrator allows authenticated privilege escalation.
Arista Networks released patches for critically severe zero-day in VCO on-prem deployments. The flaw lets authenticated users escalate to superuser privileges via low-complexity SQL injection. Patched versions include 5.2.3.18 and later. Attackers have used the flaw in real campaigns.
Unconfirmed: exact exploitation methods beyond privilege escalation not detailed
- CVE-2026-114625 tracked as critical
- Affects VeloCloud SD-WAN management
- Block malicious IPs 74.82.197.86 and 38.54.50.151
- Review access logs for anomalies
Impact: escalate privileges and compromise confidentiality integrity availability
| Product | Affected | Fixed in |
|---|---|---|
| Arista VeloCloud Orchestrator | pre-5.2.3.18, pre-6.1.3.10, pre-6.4.2.12 | 5.2.3.18, 6.1.3.10, 6.4.2.12 |
- 1.apply patches to on-prem VCO
- 2.restrict VCO web interface access
- 3.monitor for malicious IP connections
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114625 | SQL injection in Arista VeloCloud Orchestrator grants superuser | 9.4 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 38.54.50.151 | also warned security teams to block the 74[.]82.197.86 and 38[.]54.50.151 IP addresses, which have been observed during ongoing att |
| ipv4 | 74.82.197.86 | rates. The company also warned security teams to block the 74[.]82.197.86 and 38[.]54.50.151 IP addresses, which have been observed |
From the original article
2 min read at bleepingcomputer.com
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.