Arista Warns of Critical Velo Cloud SQL Injection Zero-Day Exploited in Attacks
Summary: Attackers are exploiting a zero-day SQL injection flaw, CVE-2026-114625, rated 9.9 on the CVSS scale, in Arista's VeloCloud Orchestrator, the central management system for VeloCloud SD-WAN networks, per an October 22 advisory. Anyone who can log in to the orchestrator, even with the lowest built-in customer role of Enterprise Read Only, can gain operator privileges and act as a local superuser with full access; on-premises fixes are in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, while Hosted and Dedicated orchestrators are already patched.
Bottom line: VCO is exposed by default, no VCO setting prevents that exposure, and the minimum needed to exploit it is a read-only login - the lowest role you hand out to customers - so the account tier you treat as harmless is enough to take full control of the orchestrator and the data it manages.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-114625CVE-2026-16812CVE-2026-93952
- Related
- CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista Velo Cloud Cyber Risks ·CISA Adds One Known Exploited Vulnerability to Catalog Cyber Risks · Oct 23, 2026CVE-2026-114625: Arista Velo Cloud Orchestrator SQL Injection Vulnerability Known Exploited Vulnerabilities · Oct 23, 2026