Arista Patches Exploited VeloCloud Orchestrator Flaw
The update mitigates a critical privilege escalation vulnerability currently targeted by active attacks.
Updated on Oct. 22, 2026 in Cybersecurity
Live Poll
Do you trust major technology corporations to adequately secure their software products against zero-day exploits?
Arista Networks has released security updates to address CVE-2026-114625, a zero-day vulnerability in its VeloCloud Orchestrator that is currently being exploited in active attacks. The flaw allows authenticated users to escalate their access to superuser operator status.
Why it matters
This patch is critical for administrators managing enterprise network infrastructure as attackers are actively leveraging the vulnerability to gain unauthorized control. It marks the fourth zero-day flaw Arista has been forced to remediate this year.
The vulnerability affects hosted VCO deployments running versions earlier than 5.2.3.18, 6.1.3.10, or 6.4.2.12. Attackers are currently linked to active exploitation using source IP addresses 74.82.197.86 and 38.54.50.151.
The players
Arista Networks
A provider of cloud networking hardware and software, including the VeloCloud Orchestrator platform used for managing SD-WAN deployments.
The details
The vulnerability stems from a flaw in how the orchestrator handles internal requests, allowing authenticated users to perform low-complexity SQL injection attacks—a technique that injects malicious database commands into a web application. By manipulating these queries, an attacker can bypass authorization checks to masquerade as a local superuser, the highest level of administrative access. This grants the attacker full control over the orchestrator’s internal management functions.
Timeline
May 2026: Arista patched CVE-2026-7473.
July 2026: Arista patched CVE-2026-16812.
September 2026: Arista patched CVE-2026-93952.
October 22, 2026: Arista released patches for CVE-2026-114625.
The Tech Race
The patch for CVE-2026-114625 follows the pattern of rapid remediation established by Arista Networks' 2026 security disclosure schedule. This update confirms a consistent trend of zero-day discoveries within the company's software stack throughout the year.
Administrators must immediately update their VeloCloud Orchestrator deployments to the latest version to mitigate the ongoing risk of privilege escalation. No further technical prerequisites are required beyond standard administrative access to update the software versions.
The takeaway
The exploitation of this vulnerability highlights the persistent risk of SQL injection in enterprise orchestration tools. Network administrators should monitor logs for activity from the identified IP addresses and prioritize installing the patched versions immediately.
Further reading
For more on evolving threat landscapes, see the latest Cybersecurity analysis.
Live Poll
Do you trust major technology corporations to adequately secure their software products against zero-day exploits?
