Arista Networks has patched CVE-2026-114625, a SQL injection vulnerability in its on-premises VeloCloud Orchestrator that the company says is being actively exploited. The flaw has a CVSS score of 9.9 and lets any authenticated user gain operator-level privileges.
How CVE-2026-114625 Lets Low-Privilege Users Become Operators
Any authenticated user can trigger the SQL injection, including accounts with the lowest built-in role, Enterprise Read Only. Through it, the user can gain operator privileges and masquerade as a superuser operator. Arista said it detected the flaw itself and that it is known to be exploited.
The company stated that no configuration setting prevents the exposure and that VeloCloud Orchestrator, or VCO, is exposed by default. Arista published the fix in advisory 0199 on October 22, the same day exploitation was confirmed.
On-Premises VeloCloud Orchestrator Versions Needing the Update
The vulnerability applies to on-premises VCO deployments, which Arista’s customers operate and update themselves. The hosted and dedicated offerings are run by the vendor, which explains why those instances are already protected while on-premises owners carry the upgrade work. Hosted and dedicated VCO instances are already patched by Arista. Customers running their own orchestrators must upgrade to version 5.2.3.18, 6.1.3.10 or 6.4.2.12, or to a later release. Arista said VeloCloud Gateway, VeloCloud Edge and Arista EOS are not affected.
Indicators and Mitigation Details From Arista
Arista listed two IP addresses seen in attacks, 74[.]82.197.86 and 38[.]54.50.151, and advised blocking them. The company also recommended restricting web access to VCO to administrator networks. To check for abuse, it pointed to log entries showing unusual URL path components, encoded characters and high request rates.
Preserving Logs and Contacting Arista TAC
Arista’s guidance includes preserving logs before remediation and contacting its Technical Assistance Center if compromise is suspected. Because the flaw is exploited, the order matters: applying the update can change the state of a system that investigators may want to examine.
A Pattern of Exploited Flaws in Arista’s SD-WAN and Switching Products
BleepingComputer described this as the third VCO or EOS zero-day this year. The earlier exploited flaws were CVE-2026-7473 in May, CVE-2026-16812 in July and CVE-2026-93952 in September. The sequence puts repeated attention on Arista’s management plane products across the year, with each disclosure arriving after exploitation was already underway.
What Control of a VeloCloud Orchestrator Can Reach
An SD-WAN orchestrator is the central point from which an organization configures and monitors its branch connectivity. Taking over the orchestrator can reach traffic and devices across many branch sites, which is why the privilege escalation from a read-only account is the main concern in this advisory.
The attack requires an authenticated account, but the lowest built-in role is sufficient. Any organization that issues read-only accounts widely, or whose credentials have leaked, therefore has a larger pool of accounts that could be used. Arista did not say how the attackers obtained their initial authenticated access in the observed attacks.
Open Questions About the Observed CVE-2026-114625 Attacks
Arista has not published the number of affected customers, the date exploitation began, or what the attackers did after obtaining operator privileges. The two IP addresses are the only attack-side details the company provided so far. The advisory leaves the extent of the activity unclear, and the company’s language that the flaw is “known to be actively exploited” is the full public characterization of the attacks at this point.
For customers on the 5.2, 6.1 and 6.4 release lines, the fixed builds are available now. The three fixed builds correspond to three separate branches of the orchestrator software, so each customer’s target depends on the branch currently deployed.
Arista’s advisory also describes what the abuse would look like in server logs: URL paths with odd components, encoded characters and high request rates. Those indicators are tied to the SQL injection technique and give owners a way to look back through records for earlier attempts. The company’s instruction to keep logs intact before patching reflects that the evidence of an attack may sit in the same systems that need the update.
