- Arista says attackers are exploiting CVE-2026-114625 (CVSS 9.9) in on-premises VeloCloud Orchestrator. Any logged-in user, even read-only, can gain operator privileges.
- Arista says the exposure is on by default and no configuration prevents it. Hosted versions are patched, while on-premises customers must upgrade.
- Teams should check their build against the fixed releases, limit access to the web interface, and save logs before remediation where feasible.
A login should keep trusted people apart from everyone else. Arista Networks says the weakest login in its VeloCloud Orchestrator can reach controls meant for internal use only. The company says attackers are already using that gap.
What Arista reports
Arista's advisory covers CVE-2026-114625. It scores 9.9 on the CVSS 3.1 scale and 9.4 on CVSS 4.0. The weakness type is SQL injection (CWE-89).
Arista says its own team found the problem. It also says attacks are under way.
The advisory says any logged-in user on an affected system can gain operator rights. That user can pose as a local "superuser operator". This opens functions that were not meant to be reachable from outside.
Arista has already patched its hosted versions, including Dedicated. On-premises customers must upgrade on their own. SecurityWeek reports that every release older than 5.2.3.18, 6.1.3.10 or 6.4.2.12 is affected. Arista adds that it has not assessed versions past end of support.
How the flaw works
SQL injection happens when a system treats text from a user as a database command. A crafted request can then make the database do things its designers did not intend.
Arista does not say how the injection leads to operator rights. We will not guess at it.
The advisory does say what to look for in web access logs. Watch for odd requests. These include paths that embed web-address fragments, text in escaped form, mentions of services on the local network or the host itself, and bursts of traffic.
Why "authenticated" gives little comfort
Many advisories soften the news by noting that the attacker must log in first. Here that comfort is thin. Arista names Enterprise Read Only as the minimum role. That is the least-privileged tenant account the product ships with.
An attacker also needs network access to the web interface. Beyond that, the bar is low.
The lesson here is that a login protects little when the lowest account can reach the control room. Every read-only account on the orchestrator is a possible path to operator rights.
Arista also says VCO is exposed by default. In its words, "there is no configuration that can prevent the exposure." Settings will not close this gap. Only the upgrade does.
The third in four months
SecurityWeek counts this as the third exploited zero-day Arista has fixed in VCO in four months. Before it came CVE-2026-16812, patched in July, and CVE-2026-93952, patched in September. A zero-day is a flaw that attackers use before a fix exists.
That is a count of events, not a forecast. It still raises a fair question. Could your team move a management platform to a new release three times in four months?
SecurityWeek says the attacks it describes came from two addresses, 74.82.197.86 and 38.54.50.151. It advises administrators to block both and search their logs for any trace of them.
What to ask your team
Start with simple questions. Do we run VCO on-premises? Which build? Is it older than the fixed release for its line, as listed above? If the build is off a supported line, Arista says to contact its Technical Assistance Center about upgrade options.
Then shrink the audience. Only trusted administrator networks should reach the VCO web interface.
Arista also advises watching for unexpected outbound traffic from the VCO host. It suggests blocking outbound ports that are not needed. Teams should look for backdoor daemons and webshells, which are small tools that give attackers remote control. They should also review recent administrator activity for unexpected changes.
One step comes before patching. Arista asks teams that suspect a break-in to save web, application, system and database logs, plus file timestamps, before remediation where feasible.
Last, review who holds read-only accounts on the orchestrator. In this flaw, the weakest credential is the one that matters.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Arista Networks.
