Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For
On October 22, Arista issued a security advisory warning of a critical SQL injection vulnerability in its VeloCloud Orchestrator (VCO). This flaw allows attackers with a read-only account to gain full control over VCO. Affected versions include VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12 for on-premises and Hosted/Dedicated orchestrators.
Unaffected orchestrators are those on the 7.0 release train and any not listed as vulnerable. Arista discovered three VCO vulnerabilities since late July, two of which required no login. The zero-day flaw is tracked as CVE-2026-114625. To exploit it, an attacker only needs to have network access to VCO's web interface and a valid login.
Arista has seen two IP addresses responsible for attacks and advises blocking them. They also recommend monitoring VCO logs for unusual activity. Block or check logs for suspicious requests, and save relevant logs if a compromise is suspected. Arista notes that a compromised VCO could potentially grant attackers access to VeloCloud Edge devices, but does not confirm if upgrading resolves existing access.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
