Arista Networks has issued security patches addressing an actively exploited zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem installations. The VCO platform serves as a web-based management interface enabling administrators to set up, observe, and oversee VeloCloud SD-WANs (Software-Defined Wide Area Networks) alongside their associated edge infrastructure.

Designated as CVE-2026-114625 and rated critical in severity, the vulnerability permits attackers holding basic user privileges and valid authenticated access to the VCO web interface to perform privilege escalation via low-complexity SQL injection attacks requiring no user engagement.

According to Arista, "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator."

The vendor further stated: "On an affected system, any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible."

Patched Versions

Arista has already deployed fixes to its hosted VCO instances operating on version 5.2.3.18 or higher, 6.1.3.10 or higher, and 6.4.2.12 or higher.

Interim Protective Measures

While awaiting patch deployment, Arista recommends that administrators implement several defensive steps:

  • Track inbound connections originating from recognized malicious IP addresses
  • Limit VCO web interface access exclusively to administrative network segments
  • Examine recent administrator activity logs for unexpected modifications

Additionally, administrators should inspect VCO web access logs for indicators of compromise, including requests containing atypical URL path structures, encoded character sequences, references to local or internal systems, and elevated request volumes.

Arista has identified two IP addresses engaged in ongoing exploitation attempts: 74[.]82.197.86 and 38[.]54.50.151. Security teams should block traffic from these sources.

"If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible," Arista stated, encouraging affected customers to reach out to the Arista Networks Technical Assistance Center (TAC) for further guidance.

Pattern of Recent Vulnerabilities

This represents the fourth actively exploited zero-day vulnerability Arista has addressed during the current year. The company previously patched CVE-2026-7473 in May, CVE-2026-16812 in July, and CVE-2026-93952 in September, all impacting either Extensible Operating System (EOS) or on-premises VeloCloud Orchestrator deployments.

Arista Networks ranks among the Fortune 500 and stands as one of the largest US-based corporations by revenue, serving more than 10,000 customers globally.