Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

Arista Networks patched a critical zero-day vulnerability, CVE-2026-114625, in its on-premises VeloCloud Orchestrator (VCO) deployments that was actively exploited in attacks. The flaw is a SQL injection allowing authenticated attackers with basic privileges to escalate to operator-level access, enabling them to access internal functionality and compromise the confidentiality, integrity, and availability of the orchestrator and managed data. Arista identified two IP addresses involved in ongoing exploitation and recommends immediate patching and monitoring of access logs.

AI-extracted · verify before operational use