Arista Networks patches exploited VeloCloud zero-day vulnerability

Arista Networks has released patches for a critical zero-day SQL injection vulnerability in its VeloCloud Orchestrator (VCO), which is actively being exploited by attackers. The flaw, tracked as CVE-2026-114625, has been assigned a CVSS score of 9.9.

The vulnerability allows an attacker with even the lowest level of access—an Enterprise Read Only account—to elevate their privileges to that of a superuser or operator. This level of control enables the attacker to modify or disrupt the orchestrator, access managed data, and potentially affect the host system. To exploit the flaw, an attacker requires network access to the VCO web interface and valid login credentials.

Arista confirmed that the vulnerability is being used in active attacks. While Hosted and Dedicated deployments have already been patched, on-premises operators must update to specific fixed builds, including versions 5.2.3.18, 6.1.3.10, and 6.4.2.12, or later. This incident marks the third actively exploited flaw in the VeloCloud Orchestrator reported since July 2026.