Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks

Arista has disclosed that attackers are actively abusing a critical SQL injection zero-day in VeloCloud Orchestrator (VCO), the management console behind VeloCloud SD-WAN deployments. Tracked as CVE-2026-114625 with a CVSS score of 9.9, the bug lets any logged-in user—even one holding only a read-only Enterprise customer account—escalate to full operator-level control over the orchestrator. Unlike the two previous VCO zero-days exploited in July (CVE-2026-16812) and September (CVE-2026-93952), which required no authentication at all, this one needs network access to the VCO web console plus valid, low-privilege credentials, which VCO exposes by default with no way to disable that exposure. On-premises customers must upgrade to VCO 5.2.3.18, 6.1.3.10, or 6.4.2.12, since Hosted and Dedicated instances have already been patched by Arista; VeloCloud Gateway and Edge hardware are not affected. Arista has shared two attacker IP addresses—74.82.197[.]86 and 38.54.50[.]151—and urges admins to restrict access to trusted networks, hunt for webshells and odd outbound traffic, and preserve logs before remediating if compromise is suspected.