Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months

Arista Networks has released fixes for a critical, actively exploited zero-day flaw in its VeloCloud Orchestrator (VCO) management platform, tracked as CVE-2026-114625 with a CVSS score of 9.9. The bug is a remotely triggerable SQL injection that lets any authenticated user, even one with the lowest tenant-level permissions, escalate to a hidden superuser-operator role and reach internal functionality never meant to be reachable over the network. Arista says there's no configuration workaround since on-prem VCO deployments are exposed by default, and it has already spotted exploitation traffic from two specific IP addresses. All on-premises VCO versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12 need the update, and this marks the third zero-day exploited against VCO in just four months, following CVE-2026-16812 and CVE-2026-93952.