ARISTA has disclosed that CVE-2026-114625, a critical SQL injection vulnerability in the VeloCloud Orchestrator (VCO), is being exploited in the wild. The flaw, rated CVSS 9.9, allows any authenticated user to escalate to a local “superuser operator” by abusing privileges intended for internal use. Arista notes that VCO on‑premises is exposed by default, meaning that even a stolen read‑only tenant login could be leveraged to gain full control.
VCO versions affected are 5.2.x before 5.2.3[.]18, 6.1.x before 6.1.3[.]10, and 6.4.x before 6.4.2[.]12. VeloCloud Gateway and VeloCloud Edge or Arista EOS products are not affected.
Arista has released patches for on‑prem deployments in the following releases: VCO 5.2.3[.]18, 6.1.3[.]10, and 6.4.2[.]12. Organisations still running an unsupported release should contact Arista TAC. In addition to upgrading, Arista recommends restricting the VCO web interface to trusted admin networks, blocking the attacker IPs 74.82.197[.]86 and 38.54.50[.]151, and actively monitoring for unusual outbound traffic, backdoor daemons, or webshell activity.
Administrators are advised to review recent admin activity and preserve logs and file timestamps before patching, as attackers continue to exploit this vulnerability.