Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks

Arista has disclosed a critical SQL injection zero-day vulnerability, tracked as CVE-2026-114625, in its VeloCloud Orchestrator (VCO) that is actively being exploited. The flaw allows authenticated users with even read-only access to escalate privileges to operator-level control, enabling full access to the orchestrator and potential compromise of managed SD-WAN infrastructure. The vulnerability affects on-premises VCO instances running vulnerable versions, with exploitation requiring network access and valid credentials. Arista has released patches for affected release trains and identified two IP addresses associated with ongoing attacks.

AI-extracted · verify before operational use