Arista fixes exploited VeloCloud Orchestrator privilege-escalation flaw
Arista released updates for a critical VeloCloud Orchestrator on-premises vulnerability that has been exploited in attacks. The flaw could let an authenticated low-privilege user escalate access through SQL injection and reach internal functionality. Arista patched hosted deployments and advised administrators to restrict web interface access, review logs, and block known malicious IP addresses.
Arista Networks issued fixes for an on-premises VeloCloud Orchestrator flaw, CVE-2026-114625, rated critical. An attacker already logged in with limited rights could use a simple SQL injection to reach privileged internal functions and impersonate a local superuser operator, affecting the orchestrator and managed data.
Hosted VCO environments were already updated to specified release levels. For on-prem systems, Arista recommended limiting web-interface exposure to admin networks, checking access and administrator logs for odd paths, encoded input, internal-service references, or traffic spikes, and blocking two IPs seen in attacks.
Organizations running on-premises VeloCloud Orchestrator to manage SD-WANs may face elevated risk because a compromised management portal could expose network configurations and data or disrupt connectivity for dependent users. Administrators and customers relying on those networks could be affected through service interruptions or incident-response costs. Hosted deployments appear less exposed after vendor patching, but on-prem operators still need to limit access and monitor for signs of misuse.