Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months

What it is

CVE-2026-114625 (CVSS 9.9) is a remotely exploitable SQL injection in the on-prem Arista VeloCloud Orchestrator (VCO). Arista says it detected the exploitation itself. Arista's advisory describes the result as access to privileged internal functionality that can impact the VCO host, with effects on the confidentiality, integrity and availability of VCO and the data it manages.

Preconditions / Affected

• Any authenticated user can become a local "superuser operator". That includes access to functionality meant for internal use only, which is not meant to be remotely reachable.
• The attacker needs access to the VCO web interface and a valid authenticated session. The lowest built-in tenant role is enough.
• VCO deployments are exposed by default. Arista states: "There is no configuration that can prevent the exposure."
• Affected: all releases before 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched, so only on-prem installs need action.

What to do

1. Update to a fixed release (5.2.3.18, 6.1.3.10 or 6.4.2.12 or later). Arista names this as the recommended remediation.
2. Block 74.82.197.86 and 38.54.50.151, and search logs for them.
3. Look for high request rates, and for requests with unusual URL-like path components, encoded characters, or references to local or internal services.
4. Until patched, restrict access to the VCO interface, review recent admin activity, block outbound ports, and monitor for backdoor daemons and webshells.
5. If compromise is suspected, preserve VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediating, where operationally feasible.

Caveats

• Arista publishes no exploit details or log signatures beyond the indicator types above, so the two IP addresses are the only concrete indicators.
• Blocking the IPs and restricting access only reduces exposure. Arista offers no configuration that removes the flaw, so patching is the only fix.
• The IP list covers observed attacks only. Other source addresses are possible.
• This is the third exploited VCO zero-day in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September. The page gives no detail on whether earlier compromises overlap with this one, so hosts exposed during that period may warrant the same log review.