Arista VeloCloud Zero-Day CVE-2026-114625 Exploited

Active exploitation confirmed. Arista disclosed CVE-2026-114625 on October 22: a CVSS 9.9 SQL injection flaw in VeloCloud Orchestrator (VCO) on-premises deployments that lets any authenticated user escalate to superuser operator privileges.

What it does. The flaw is in the VCO web interface. A low-complexity attack, no user interaction required, lets an authenticated attacker inject SQL and gain operator-level access. That includes internal functionality not meant to be remotely reachable.

Exploitation status. Ongoing attacks observed. Two attacker IPs have been identified in active campaigns: 74.82.197.86 and 38.54.50.151. Treat these as IOCs for immediate log review.

Affected versions and patches. On-premises VCO only. Fixed versions: 5.2.3.18, 6.1.3.10, and 6.4.2.12. Hosted and Dedicated VCO instances were patched by Arista before public disclosure.

What to do. Upgrade to a fixed build. If patching is not immediate: restrict VCO web interface access to administrative networks, block the known attacker IPs at the perimeter, and review VCO access logs for signs of privilege escalation.

This is the third VeloCloud Orchestrator flaw to reach confirmed exploitation since July. The pattern is consistent: VCO on-prem is a target. CVE-2026-93952, a CVSS 10.0 RCE, hit the CISA KEV catalog in September. CVE-2026-16812 preceded it in July. Three KEV-eligible flaws in one platform in four months warrants a hard look at your VCO exposure surface, not just this patch cycle.

Confidence: exploitation confirmed per vendor and independent researcher reporting. CVE details verified against NVD.