Dark Web Intelligence (@DailyDarkWeb) on X

What it is

CVE-2026-114625 is a SQL injection (CVSS 3.1 9.9) in on-prem Arista VeloCloud Orchestrator (VCO), the SD-WAN management portal. Arista Security Advisory 0199, published 22 October 2026, says it is known to be exploited. This page is a post by @DailyDarkWeb summarizing the advisory, not the advisory itself.

Preconditions / Affected

• The attacker needs a valid login. The lowest Enterprise Read Only tenant role is enough, and it yields a local "superuser operator" account.
• The flaw is exposed by default, and no configuration prevents it.
• Hosted and Dedicated VCO are already patched. Only self-managed on-prem deployments need action.

What to do

Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12, depending on your release train.

@DailyDarkWeb adds three steps of its own, which are not quoted from Arista:

• Restrict the VCO web UI to admin networks.
• Search logs for the two observed attacker IPs.
• If compromise is suspected, preserve logs before remediation.

74.82.197.86
38.54.50.151

Because any tenant login can trigger the flaw, review who holds Enterprise Read Only accounts, including stolen or stale credentials. The poster's reasoning is that one stolen read-only login is sufficient.

Caveats

• The post does not describe the injection point, the exploit request or any log signature, so the IPs are the only concrete indicators.
• Restricting the UI to admin networks is the poster's suggestion. The page does not say Arista offers it as a workaround, and it does not replace the patch.
• The claim that this is Arista's fourth exploited VCO/EOS zero-day this year is the poster's analyst note, with no supporting detail.
• The Arista advisory link is truncated on the page, so check the advisory for the full affected-version ranges.