Arista Patches Critical VeloCloud Orchestrator Flaw
The company issued security updates to address a zero-day vulnerability currently being exploited by attackers.
Updated on Oct. 22, 2026 in Cybersecurity
Live Poll
Do you trust major technology corporations to adequately secure their software products against zero-day exploits?
Arista Networks has released emergency patches for its VeloCloud Orchestrator after discovering an active exploitation of a zero-day vulnerability. The flaw allows attackers with basic privileges to escalate their access to superuser operator status.
Why it matters
The vulnerability poses a significant security risk because it allows authenticated users to access privileged internal functions through simple SQL injection attacks. Attackers are already actively targeting systems using specific malicious IP addresses.
The vulnerability affects hosted VCO deployments running versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12. Ongoing attacks have been traced to malicious IP addresses 74.82.197.86 and 38.54.50.151.
The players
Arista Networks
This company is a prominent provider of cloud networking and data center switching solutions based in the United States.
The details
Attackers are utilizing low-complexity SQL injection methods to bypass security protocols. Once authenticated, they masquerade as local superuser operators to gain unauthorized control over the platform's internal functionality.
Timeline
May 2026: Arista patched a previously exploited vulnerability.
July 2026: The company addressed another zero-day flaw.
September 2026: A third zero-day vulnerability was patched.
October 22, 2026: Patches were released for the current CVE-2026-114625 vulnerability.
The Tech Race
This incident marks the fourth time this year that Arista has had to remediate an actively exploited zero-day flaw in its systems. The recurring nature of these security gaps highlights the intense pressure on network infrastructure providers to harden internal functionality against SQL injection attacks.
Administrators managing VeloCloud Orchestrator deployments must update their software immediately to versions 5.2.3.18, 6.1.3.10, or 6.4.2.12 to prevent unauthorized access. Failure to patch these systems leaves internal network controls vulnerable to exploitation by known malicious actors.
The takeaway
Security teams should prioritize patching this vulnerability to mitigate the risk of privilege escalation. Monitoring network traffic for activity linked to the identified malicious IP addresses is recommended for immediate threat detection.
Further reading
For additional insights on protecting enterprise infrastructure, visit the Cybersecurity section.
Live Poll
Do you trust major technology corporations to adequately secure their software products against zero-day exploits?
