ARISTA Networks has released patches for a third exploited zero-day in its VeloCloud Orchestrator (VCO), a central management tool used in software-defined networking. The vulnerability, tracked as CVE-2026-114625, is a critical SQL injection that can be exploited remotely to gain access to privileged internal functionality and elevate an authenticated user to operator or “superuser operator” status.
Arista warns that on affected systems, any authenticated user could access internal-only features and potentially compromise the VCO host, with impact to confidentiality, integrity and availability of both VCO and the data it manages. The flaw affects all VCO releases prior to 5.2.3[.]18, 6.1.3[.]10, and 6.4.2[.]12; Arista has already patched hosted deployments and urges on‑premises customers to update as soon as possible.
According to Arista, the issue is actively being exploited and VCO deployments are exposed by default. Attack activity has been observed originating from two IP addresses (74.82.197[.]86 and 38.54.50[.]151); administrators are advised to block these addresses, review logs, and look for high request rates or unusual URL-like paths, encoded characters and references to internal services.
If compromise is suspected, operators should preserve a broad range of logs (web access, backend, system, database, file timestamps) before remediation. The recommended action is to update to a fixed VCO release; until then, restrict VCO interface access, monitor for suspicious admin activity, block outbound ports, and watch for backdoors or webshells. This is the third such exploited zero-day in VCO within four months, following CVE-2026-16812 in July and CVE-2026-93952 in September.