Arista patches actively exploited VeloCloud Orchestrator zero-day CVE-2026-114625 (CVSS 9.9, authenticated SQL injection)

Linha do tempo

1. thehackernews.com ↗ · pub. 22/10/2026 16:05 · coletado 22/10 18:00

   Arista warns of exploited VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625 (CVSS 9.9)

   The article adds the CVSS 9.9 score and shows the flaw is reachable with the lowest Enterprise Read Only role. It says VCO is exposed by default and that releases fixing the July and September flaws remain vulnerable. It lists the fixed release per train, says Gateway, Edge and the 7.0 train are unaffected, and notes the September flaw is still unfixed on the 6.1 train. It also gives additional mitigation and hunting guidance, and says Hosted and Dedicated orchestrators were already patched.

   ler a análise desta fonte ocultar

   The article adds the CVSS 9.9 score and shows the flaw is reachable with the lowest Enterprise Read Only role. It says VCO is exposed by default and that releases fixing the July and September flaws remain vulnerable. It lists the fixed release per train, says Gateway, Edge and the 7.0 train are unaffected, and notes the September flaw is still unfixed on the 6.1 train. It also gives additional mitigation and hunting guidance, and says Hosted and Dedicated orchestrators were already patched.

   Arista disclosed on October 22 that attackers are exploiting CVE-2026-114625, a zero-day SQL injection flaw in VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN. The flaw is rated CVSS 9.9. Any user who can log in, even with the lowest Enterprise Read Only role, can gain operator privileges and act as a local superuser. It is the third VCO flaw Arista has reported as exploited since late July, and the first that requires authentication. The advisory does not say when the attacks began, which orchestrators were hit, or what attackers did afterward.

   Technical Details

   • Exploitation needs network access to the VCO web interface and a valid login. VCO is exposed by default and no setting prevents this.
   • The flaw may also let an attacker affect the VCO host itself and expose, modify or disrupt the orchestrator and its data.
   • Orchestrators on the releases that fixed the July flaw (CVE-2026-16812) and the September flaw (CVE-2026-93952) remain affected, because those releases are older than the new fixes.
   • Neither earlier flaw required a login. For those two, Arista warned that a compromised orchestrator could grant access to VeloCloud Edge devices. The advisory is silent on whether that applies here.
   • VeloCloud Gateway and Edge are not affected. The 7.0 train is not listed and is not vulnerable. End-of-support releases were not checked.
   • Arista reports two attacker IP addresses (not reproduced in the article text).
   • Arista advises checking VCO web access logs for unusual URL-like path components, encoded characters, references to internal services and high request rates.
   • As of October 22, the September flaw is fixed only in the 5.2 and 6.4 trains. On 6.1 it affects releases up to 6.1.3.7 and no fixed release is listed.

   Remediation

   • On-prem: upgrade to VCO 5.2.3.18, 6.1.3.10 or 6.4.2.12. Hosted and Dedicated orchestrators are already patched.
   • Restrict VCO web interface access to trusted administrative networks.
   • Block the two attacker IPs and monitor for connections from known malicious addresses.
   • Watch for unexpected outbound traffic from the VCO host, consider blocking unneeded outbound ports, and hunt for backdoor daemons and webshells.
   • Review recent administrator activity for unexpected changes.
   • If compromise is suspected, preserve web access, backend application, system and database logs and file-system timestamps before fixing. Customers on unsupported trains should contact Arista TAC.
2. bleepingcomputer.com ↗ · pub. 22/10/2026 14:18 · coletado 22/10 16:00 primeiro registro

   Arista patches actively exploited VeloCloud Orchestrator on-prem zero-day CVE-2026-114625 (privilege escalation)

   ler a análise desta fonte ocultar

   Arista Networks released security updates for CVE-2026-114625, a critical zero-day in VeloCloud Orchestrator (VCO) On-Prem that is being actively exploited. An authenticated user with basic privileges and access to the VCO web interface can escalate to operator privileges and masquerade as a local "superuser operator", reaching internal-only functionality and affecting the VCO host. Exploitation can compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. Arista has published two attacker IP addresses seen in ongoing attacks. It is the fourth actively exploited Arista zero-day this year, following CVE-2026-7473 (May), CVE-2026-16812 (July) and CVE-2026-93952 (September), which affected EOS and on-prem VCO deployments.

   Technical Details

   • The flaw is described as low-complexity SQL injection requiring no user interaction, exploitable by any authenticated user with basic privileges.
   • Attackers gain operator privileges and access functionality that is not intended to be remotely accessible.
   • Attacker IPs observed in ongoing attacks: 74.82.197.86 and 38.54.50.151.
   • Suspicious indicators in VCO web access logs include requests with unusual URL-like path components, encoded characters, references to local or internal services, and high request rates.

   Remediation

   • Hosted VCO deployments are already patched on versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later; on-prem customers should apply the updates.
   • Until patched, block the two IP addresses, monitor for connections from known malicious IPs, and restrict access to the VCO web interface to administrative networks.
   • Review recent administrator activity for unusual changes and review VCO web access logs.
   • If compromise is suspected, preserve web access, backend application, system and database logs and file-system timestamps before remediation, and contact the Arista TAC.