Arista Networks has issued critical patches for a zero-day vulnerability discovered in its VeloCloud Orchestrator (VCO) management tool. This vulnerability, labeled CVE-2026-114625, is a high-severity security flaw with a CVSS score of 9.9, capable of remote exploitation through SQL injection.
Details of the Security Flaw
The security issue within VeloCloud Orchestrator allows remote attackers to access privileged internal functions, potentially compromising the confidentiality, integrity, and availability of the orchestrator and its data. The flaw enables any authenticated user to gain operator-level privileges and operate as a ‘superuser operator’, granting access to internal functionalities not intended for remote accessibility.
All VCO versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12 are vulnerable. Arista has patched the hosted versions of VCO but strongly advises users to update their on-premises systems without delay.
Active Exploitation and Mitigation
Arista has confirmed that the vulnerability is actively being exploited, with VCO deployments being exposed by default. Attackers require access to the VCO web interface and an authenticated session, even with minimum privileges, to exploit the flaw. The company has observed attacks originating from IP addresses 74.82.197.86 and 38.54.50.151, recommending blocking these addresses and monitoring logs for suspicious activity and high-request rates.
Administrators are urged to preserve various logs and timestamps before remediation if a compromise is suspected. Immediate updates to the fixed VCO releases are advised, along with restricting VCO interface access, reviewing admin activity, and monitoring for any backdoor daemons or webshells.
Ongoing Security Challenges
This recent zero-day is the third such vulnerability in VeloCloud Orchestrator that Arista has addressed in four months, following similar issues in July and September. The continuous nature of these vulnerabilities highlights ongoing challenges in securing centralized management tools against sophisticated cyber threats.
Organizations using the VCO are encouraged to remain vigilant and proactive in applying security patches and monitoring network activity to safeguard against potential breaches.
For further information on related security updates, recent advisories include those from Atlassian, Signal, Splunk, SolarWinds, and Cisco, focusing on addressing multiple vulnerabilities across various products.
