KIungefiltert

· 4 min read · Auf Deutsch lesen

Arista VeloCloud Orchestrator: third exploited zero-day in four months

An SQL injection in on-prem VeloCloud Orchestrator (CVE-2026-114625, CVSS 9.9) is under active attack. A read-only login is enough to gain operator rights. Patches exist for 5.2, 6.1 and 6.4.

security

Translated from the German original with an AI language model, approved by me. Read the original

Arista is warning about a critical flaw in VeloCloud Orchestrator (VCO) that attackers are already exploiting. It's the third exploited VCO zero-day in roughly four months. A zero-day is a flaw that attackers exploit before a patch is available. On October 23, 2026, the US agency CISA added the vulnerability to its KEV catalog. KEV stands for "Known Exploited Vulnerabilities" and only lists flaws with confirmed exploitation in the wild.

What happened

The flaw is tracked as CVE-2026-114625. It's an SQL injection: an attacker slips their own database commands into input that the application passes to its database without proper checks. According to The Hacker News and SecurityWeek, Arista rates it CVSS 9.9 out of 10. A few other reports cite 9.4, but that doesn't change its critical rating.

VCO is the central management console for VeloCloud SD-WANs. SD-WAN means software-defined networking between sites: branch offices, data centers and cloud links are all configured through it. Whoever controls the orchestrator controls a large part of the company network.

An attack requires network access to the web interface and a valid login. That sounds like a barrier, but it's a low one. According to Arista, even the weakest built-in role is enough. That role is "Enterprise Read Only", a pure read-only account. With it, an attacker can gain operator privileges and impersonate a local "superuser operator". That's the highest level of control in VCO. BleepingComputer reports that the attack has low complexity and needs no user interaction.

What has changed since my post

More details are out now. The fixed versions are known, the CVSS score is published, and the scope is clearer. The two earlier flaws, from July (CVE-2026-16812) and September (CVE-2026-93952), could be exploited without a login. The new flaw is the first of the three that requires an account.

According to The Hacker News, several questions remain open. Arista hasn't said when the attacks started, which orchestrators were hit, or what the attackers did afterward. It's also unclear whether updating removes access an attacker has already gained.

Who is affected

On-prem VCO installations running these versions are affected:

  • 5.2 before 5.2.3.18
  • 6.1 before 6.1.3.10
  • 6.4 before 6.4.2.12

Arista has already patched its hosted and dedicated orchestrators. VeloCloud Gateway and Edge are not affected, and neither is the 7.0 branch. Arista hasn't evaluated end-of-support releases. If you run one, contact Arista support (TAC). According to The Hacker News, Arista also notes that VCO is exposed by default and that no configuration setting prevents this. The sources don't say how many installations are affected.

What you should do now

  1. Install the update. Upgrade to 5.2.3.18, 6.1.3.10, 6.4.2.12 or later. If you're on 6.1, also check whether the September flaw is covered. According to The Hacker News, Arista lists no fixed 6.1 release for it.
  2. Restrict access. Make the web interface reachable only from trusted admin networks, and block unneeded outbound connections from the VCO host.
  3. Clean up accounts. Since a read-only account is enough, every forgotten or shared login is a risk. Review accounts and remove the ones you don't need.
  4. Look for traces. Arista's advisory lists two IP addresses seen in attacks. Block them and search your logs for them. Also watch for unusual paths, encoded characters, references to internal services and high request rates. Check recent admin activity for unexpected changes, and look for webshells and backdoor daemons.
  5. Preserve evidence if you suspect compromise. Save web, application, system and database logs plus file timestamps before cleaning up, then contact Arista TAC.

My take

Three exploited zero-days in the same management product within a few months is no accident. Attackers are clearly targeting VCO because it's a lucrative target: whoever takes it over holds the keys to the entire site network. If you run VCO on-prem, treat it like a domain controller. That means keeping it off the open internet, patching immediately and actively monitoring its logs. After this series, I'd also seriously consider whether the hosted version is the calmer choice. This time it was already patched when the news broke.

Sources