Arista patches a VeloCloud Orchestrator zero-day already used in attacks, the third in four months

Arista Networks has released fixes for CVE-2026-114625, a critical SQL injection flaw in on-premises deployments of VeloCloud Orchestrator. Attackers have already exploited it. VeloCloud Orchestrator is a web-based portal that administrators use to configure, monitor and manage VeloCloud software-defined WANs and their edge devices. The flaw has a CVSS score of 9.9. Arista says that on an affected system, "any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user." That includes access to internal-only functions that are not meant to be reachable remotely. According to BleepingComputer, an attacker needs basic privileges, access to the web interface and a valid session, and the attack is low in complexity and requires no user interaction. Successful exploitation could compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. All releases before versions 5.2.3.18, 6.1.3.10 and 6.4.2.12 are affected. Arista says hosted deployments have already been patched and urges customers to update on-premises installations as soon as possible. SecurityWeek reports that this is the third VeloCloud Orchestrator zero-day exploited in four months. That pattern matters for organizations that run these management servers themselves, because an orchestrator controls configuration across a company's whole wide-area network.