Attackers are actively exploiting a critical SQL injection vulnerability in VeloCloud Orchestrator (VCO) that enables authenticated users to escalate to superuser operator access.
Arista Networks disclosed the flaw on October 22, 2026, warning that successful exploitation could compromise the orchestrator, its host, and the data it manages. Arista says hosted deployments, including Dedicated instances, have already been patched.
Tracked as CVE-2026-114625, the issue has a CVSS v3.1 score of 9.9 and a CVSS v4.0 score of 9.4. Arista discovered the problem and confirmed active exploitation in the wild.
Security Advisory 0199 classifies the weakness as CWE-89 (SQL injection) and records it internally as BUG2043622. Exploitation requires network access to the VCO web interface and a valid authenticated portal session; an administrator account is not required.
The built-in tenant role Enterprise Read Only, the lowest privilege role, provides sufficient access to exploit the vulnerability. The attack requires no user interaction and is considered low complexity.
Upon success, an attacker can obtain operator privileges and impersonate a local “superuser operator” account, granting access to internal functions that should not be reachable remotely.
Arista warns that exploitation can impact the confidentiality, integrity, and availability of both the orchestrator and the data it manages.
It is important to note the login requirement: this is not an unauthenticated remote attack, but a low-privilege account can be leveraged to gain far broader control.
Hackers exploiting VeloCloud Orchestrator flaw
Arista says VCO is exposed by default and there is no product configuration that removes that exposure; restricting network access is a temporary mitigation, not a fix. This disclosure follows earlier VCO exploitation that involved a separate command injection vulnerability.
Separately, recent reports described SonicWall SQL injection flaws that could elevate read-only access to administrator control; those incidents involve different vulnerabilities and are not the same as this VCO issue.
Affected on-premises releases are VCO 5.2.x prior to 5.2.3.18, VCO 6.1.x prior to 6.1.3.10, and VCO 6.4.x prior to 6.4.2.12. Administrators should upgrade to the fixed release in their current release train or to a later version. Arista has not evaluated software that has reached end of support.
VeloCloud Gateway and VeloCloud Edge are not affected. Arista also lists EOS-based products and other named platforms as unaffected. Operators should consult the affected-software list rather than assuming all Arista or VeloCloud products require the same update.
Arista identified 74.82.197.86 and 38.54.50.151 as source IP addresses observed conducting attacks. Security teams should block those addresses and search historical logs for related activity.
Investigations should look for unusual URL-like paths, encoded characters, references to local or internal services, and unusually high request rates.
Where possible, teams should preserve web access, backend application, system, and database logs, along with relevant file timestamps, before remediating systems.
Arista also recommends restricting web access to trusted administrative networks, checking for unexpected outbound connections, reviewing administrator account changes, and monitoring for backdoors or webshells.
Customers running releases outside supported trains should contact the Arista Technical Assistance Center about upgrade options. These interim controls reduce exposure, but installing a fixed release is the recommended resolution.
Because exploitation has been confirmed in the wild, affected organizations should prioritize patching and conduct a review for signs of compromise rather than treating the upgrade as routine maintenance.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
