Attackers exploit VeloCloud Orchestrator flaw for superuser access
Original title: Hackers Actively Exploiting Critical VeloCloud Orchestrator Flaw to Gain Superuser Access
CVE-2026-114625 is an authenticated SQL injection; Enterprise Read Only is enough, and Arista named two attacking IPs.
Arista Networks says attackers are exploiting CVE-2026-114625, a critical SQL injection in VeloCloud Orchestrator that lets a logged-in user gain superuser operator access. The bug scores 9.9 on CVSS v3.1 and needs network access plus any valid portal session, including the lowest built-in tenant role. Hosted deployments, including Dedicated instances, are already patched. On-premises fixes are 5.2.3.18, 6.1.3.10, and 6.4.2.12 or later in those trains. VeloCloud Gateway and Edge are not affected.
Unconfirmed: Arista confirmed exploitation but did not name the attackers.
- Arista disclosed the issue on October 22, 2026, as advisory 0199 and BUG2043622.
- CVSS v4.0 score is 9.4; the weakness is CWE-89.
- Observed attack sources are 74.82.197.86 and 38.54.50.151.
- VCO is exposed by default; no product setting removes that exposure.
- End-of-support software was not assessed.
Impact: Authenticated user gains superuser operator control of the orchestrator
| Product | Affected | Fixed in |
|---|---|---|
| Arista Networks VeloCloud Orchestrator | 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12 | 5.2.3.18, 6.1.3.10, 6.4.2.12 |
- 1.Upgrade on-premises VCO to the fixed release in the current train or later.
- 2.Block 74.82.197.86 and 38.54.50.151 and search logs for related activity.
- 3.Restrict the VCO web interface to trusted administrative networks and look for webshells.
- CVEs
- CVE-2026-114625
- Vendors
- Arista Networks
- Products
- VeloCloud Orchestrator
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114625 | SQL injection in Arista VeloCloud Orchestrator grants superuser | 9.4 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 38.54.50.151 | t needs the same update. Arista identified 74.82.197.86 and 38.54.50.151 as source IP addresses observed conducting attacks. Securit |
| ipv4 | 74.82.197.86 | VeloCloud product needs the same update. Arista identified 74.82.197.86 and 38.54.50.151 as source IP addresses observed conducting |
From the original article
2 min read at cybersecuritynews.com
Hackers are actively exploiting a critical SQL injection flaw in VeloCloud Orchestrator (VCO) that allows logged-in users to gain superuser operator access. Arista Networks disclosed the vulnerability on October 22, 2026, warning that successful attacks could compromise the orchestrator, its host, and the data it manages. Arista has already patched hosted deployments, including Dedicated instances.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.