Arista says VeloCloud SQL injection zero-day is exploited
Original title: Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
A read-only login can become a local superuser; on-prem fixes are 5.2.3.18, 6.1.3.10 and 6.4.2.12.
Arista said on October 22 that attackers are exploiting CVE-2026-114625, a SQL injection in VeloCloud Orchestrator rated 9.9. A user who can reach the web interface and log in, including with Enterprise Read Only, can gain operator privileges and may affect the host and its data. On-premises fixes are VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12; hosted and dedicated orchestrators are already patched. Arista has not said when the attacks began or which orchestrators were hit.
Unconfirmed: Arista has not said when attacks began, which systems were hit, or whether an upgrade removes access already gained.
- Attack source IPs named by Arista are 74.82.197[.]86 and 38.54.50[.]151.
- Gateway, Edge and any release not listed, including 7.0, are not affected.
- Fixes for the July and September flaws are older and remain vulnerable.
- End-of-support trains were not checked; customers can contact TAC.
Impact: Logged-in user gains operator or local superuser control
| Product | Affected | Fixed in |
|---|---|---|
| Arista VeloCloud Orchestrator 5.2 | Before 5.2.3.18 | 5.2.3.18 and later |
| Arista VeloCloud Orchestrator 6.1 | Before 6.1.3.10 | 6.1.3.10 and later |
| Arista VeloCloud Orchestrator 6.4 | Before 6.4.2.12 | 6.4.2.12 and later |
- 1.Upgrade on-premises VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12.
- 2.Block 74.82.197[.]86 and 38.54.50[.]151 and search logs for them.
- 3.Limit the VCO web interface to trusted administrative networks.
- CVEs
- CVE-2026-114625
- Vendors
- Arista
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114625 | SQL injection in Arista VeloCloud Orchestrator grants superuser | 9.4 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 38.54.50.151 | d check logs for any sign of them: IP : 74.82.197[.]86 IP : 38.54.50[.]151 Also check VCO web access logs for requests with unusual |
| ipv4 | 5.2.3.16 | (September) fixed in 5.2 Before 5.2.3.18 5.2.3.18 and later 5.2.3.16 6.1 Before 6.1.3.10 6.1.3.10 and later No fix listed 6.4 Be |
| ipv4 | 5.2.3.18 | 625 Fixed in CVE-2026-93952 (September) fixed in 5.2 Before 5.2.3.18 5.2.3.18 and later 5.2.3.16 6.1 Before 6.1.3.10 6.1.3.10 an |
| ipv4 | 6.1.3.10 | 5.2 Before 5.2.3.18 5.2.3.18 and later 5.2.3.16 6.1 Before 6.1.3.10 6.1.3.10 and later No fix listed 6.4 Before 6.4.2.12 6.4.2. |
| ipv4 | 6.4.2.12 | Before 6.1.3.10 6.1.3.10 and later No fix listed 6.4 Before 6.4.2.12 6.4.2.12 and later 6.4.2.8 VeloCloud Gateway and VeloCloud |
| ipv4 | 6.4.2.8 | later No fix listed 6.4 Before 6.4.2.12 6.4.2.12 and later 6.4.2.8 VeloCloud Gateway and VeloCloud Edge are not affected. The |
| ipv4 | 74.82.197.86 | rista. Block them and check logs for any sign of them: IP : 74.82.197[.]86 IP : 38.54.50[.]151 Also check VCO web access logs for re |
From the original article
3 min read at thehackernews.comAttackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.