Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

Arista Networks has issued fixes for a critical zero-day bug in on-premises deployments of VeloCloud Orchestrator (VCO), the web console used to manage SD-WAN edge infrastructure, after confirming it is already being exploited. The flaw, identified as CVE-2026-114625, lets a logged-in user with only basic access exploit a low-complexity SQL injection flaw—no user interaction needed—to escalate to operator-level rights and impersonate an internal superuser account, potentially exposing or altering orchestrator data. Arista has shipped patched versions 5.2.3.18+, 6.1.3.10+, and 6.4.2.12+, and until updates are applied recommends limiting web interface access to admin networks, auditing recent admin actions, watching for odd log entries, and blocking attacker IPs 74.82.197.86 and 38.54.50.151. This marks the fourth actively exploited zero-day Arista has patched in VCO or EOS products in 2026 alone.