ARISTA has disclosed a critical zero-day vulnerability in its VeloCloud Orchestrator (VCO) that is being exploited in the wild. The flaw, tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale, is a SQL injection that can be exploited by anyone who can log in to the VCO web interface, including a read-only Enterprise account. On‑premises orchestrators can be fixed with VCO 5.2.3[.]18, 6.1.3[.]10, or 6.4.2[.]12, while Hosted and Dedicated deployments have already been patched.
Arista notes that the flaw affects orchestrators running releases that previously fixed related vulnerabilities (from July and September) because those older releases are still vulnerable. The issue marks the third VCO flaw in the latter part of 2026 that Arista has said was exploited, and it is the first to require login credentials.
The attacker’s access could grant operator-level privileges, effectively allowing the intruder to act as a local superuser and potentially influence the VCO host and the data it manages. To exploit the flaw, an attacker needs network access to the orchestrator’s web interface and a valid login; VCO is exposed by default and there is no setting to prevent exposure. Arista’s advisory provides remediation guidance and a concrete list of two IP addresses observed delivering attacks: 74.82.197[.]86 and 38.54.50[.]151.
In the interim, the company recommends restricting web interface access to trusted networks, monitoring for connections from known malicious IPs, and reviewing administrator activity for anomalies, alongside general steps to limit outbound access and detect backdoors.