Arista fixes actively exploited security bug in VeloCloud Orchestrator

Arista Networks has rolled out security fixes for an actively targeted zero-day vulnerability impacting on-premises installations of its VeloCloud Orchestrator portal. Tracked as CVE-2026-114625, the critical security flaw allows remote attackers possessing valid authenticated sessions and basic user privileges to access internal system features and escalate their control. [1][2]

The bug relies on low-complexity SQL injection attacks requiring no user interaction, enabling an intruder to masquerade as a local superuser operator and compromise orchestrator data. Arista confirmed that hosted deployments running versions 5.2.3.18, 6.1.3.10, 6.4.2.12 or newer are protected, and the company urged administrators to restrict portal access and block malicious IP addresses tied to ongoing exploitation. [1][2]

This incident marks the third zero-day vulnerability affecting VeloCloud Orchestrator exploited by attackers in the span of four months. It also follows several other high-profile zero-day patches issued by Arista throughout 2026 across its enterprise network portfolio. [1][2]