Attackers exploit VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625
Original title: Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
Any authenticated user on unpatched on-prem VCO can become a superuser operator; Arista says hosted systems are already patched.
Arista Networks patched CVE-2026-114625, a critical remotely exploitable SQL injection (CVSS 9.9) in on-premises VeloCloud Orchestrator. The company says the flaw is actively exploited and lets any authenticated user, including the lowest built-in tenant role, gain operator privileges and reach internal functionality. Releases before 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected. Hosted VCO is already patched. This is the third exploited VCO zero-day Arista has patched in four months.
Unconfirmed: Arista says exploitation is known but does not name the attackers.
- Attacks were seen from 74.82.197.86 and 38.54.50.151.
- VCO is exposed by default, and Arista says no configuration prevents exposure.
- Attackers need the web interface and a valid authenticated session.
- Fixed on-prem releases are 5.2.3.18, 6.1.3.10, and 6.4.2.12.
Impact: Authenticated user gains operator privileges on the VCO host
| Product | Affected | Fixed in |
|---|---|---|
| Arista Networks VeloCloud Orchestrator | All releases before 5.2.3.18, 6.1.3.10, and 6.4.2.12 | 5.2.3.18, 6.1.3.10, and 6.4.2.12 |
- 1.Update on-premises VCO to 5.2.3.18, 6.1.3.10, or 6.4.2.12.
- 2.Block 74.82.197.86 and 38.54.50.151 and search logs for them.
- 3.Restrict VCO interface access until the fixed release is deployed.
- CVEs
- CVE-2026-114625
- Vendors
- Arista Networks
- Products
- VeloCloud Orchestrator
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114625 | SQL injection in Arista VeloCloud Orchestrator grants superuser | 9.4 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 38.54.50.151 | bserved originating from two IP addresses, 74.82.197.86 and 38.54.50.151. Administrators should block them, check logs for their pre |
| ipv4 | 74.82.197.86 | tacks have been observed originating from two IP addresses, 74.82.197.86 and 38.54.50.151. Administrators should block them, check l |
From the original article
2 min read at securityweek.com
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges. The post Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.