Arista Networks has published security updates for a critical zero-day in on-premises VeloCloud Orchestrator (VCO) deployments that is already being used in attacks. VCO is the web-based portal through which administrators configure, monitor and manage VeloCloud software-defined WANs and the edge devices attached to them.
The vulnerability is tracked as CVE-2026-114625. Reaching it takes only basic privileges, network access to the VCO web interface and a valid authenticated session; from there, a low-complexity SQL injection — no user interaction required — lets an attacker escalate privileges.
In Arista's description, exploitation "may allow a remote attacker to access privileged internal functionality and impact the VCO host," with possible consequences for the confidentiality, integrity and availability of the orchestrator and the data it handles. The vendor was more specific about the escalation path: "On an affected system, any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user," gaining entry to functions reserved for internal use that were never meant to be reachable remotely.
Patched builds and workarounds
For on-premises VCO, the Arista advisory lists these fixed builds: 5.2.3.18 and later within the 5.2 train; 6.1.3.10 and later within the 6.1 train; and 6.4.2.12 and later within the 6.4 train. Hosted deployments, including Dedicated instances, have already been patched.
For installations still awaiting the update, Arista's interim advice covers three areas: confine VCO web interface access to administrative networks, watch for inbound connections from addresses already tied to the campaign, and go back over recent administrator activity looking for unexplained changes. Web access logs are worth a separate pass — the vendor points to requests carrying odd URL-like path segments, encoded characters, or references to local and internal services, as well as unusually high request volumes, as patterns to hunt for.
Two indicators were named for blocking: 74[.]82.197.86 and 38[.]54.50.151, both described by Arista as having appeared during the ongoing attacks.
Where an intrusion is suspected, the company asks operators to hold on to VCO web access logs, backend application logs, system logs, database logs and the relevant file-system timestamps before starting remediation, "where operationally feasible." Customers can also approach the Arista Networks Technical Assistance Center (TAC) for further support.
A repeated pattern in 2026
The VCO bug is the fourth Arista zero-day in 2026 that the company has patched after reports of live exploitation. Earlier ones were CVE-2026-7473 in May, CVE-2026-16812 in July and CVE-2026-93952 in September, spanning Arista's Extensible Operating System (EOS) and on-premises VCO.
Arista Networks is a Fortune 500 company and among the largest US corporations by revenue, counting more than 10,000 customers worldwide, BleepingComputer reported.
Editorial update: clarified which release trains and deployment types the fixed builds apply to.
