Arista patches actively exploited VeloCloud Orchestrator zero-day, CVE-2026-114625

Arista Networks released security updates on October 22, 2026 for an actively exploited zero-day in VeloCloud Orchestrator (VCO) On-Prem, the web based management portal used to configure, monitor and manage VeloCloud SD-WAN deployments and their edge devices. The flaw, CVE-2026-114625, is a critical SQL injection (CWE-89, CVSS v3.1 9.9) that lets an authenticated user with basic privileges and a valid session escalate to operator privileges and masquerade as a local superuser operator, reaching privileged internal functionality. Arista says successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. Affected releases are VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12.

Hosted and dedicated VCO deployments were also impacted and have already been patched to those fixed versions. Until on-premises systems are updated, Arista advises administrators to block the attacker addresses 74.82.197.86 and 38.54.50.151, which have been observed in ongoing attacks, restrict the VCO web interface to administrative networks, and review web access logs and recent administrator activity for unusual changes. If compromise is suspected, operators should preserve VCO web access, backend application, system and database logs before remediation where feasible.

Update, October 23: CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on October 23, 2026, based on evidence of active exploitation, with a federal remediation due date of October 26, 2026. Carthage Electronics, reporting both October 23 KEV additions, puts the catalog at version 2026.10.23 with 1,756 entries and notes the listing carries forensic triage expectations for federal agencies. This item stays in the CRITICAL band; the KEV listing confirms the tier the item already held for active exploitation of widely deployed technology. The fixed versions and the Arista advice above are unchanged.

Sources: BleepingComputer; Arista Security Advisory 0199; CISA; Carthage Electronics