Arista patches exploited VeloCloud flaw that grants authenticated users operator access
Arista has patched CVE-2026-114625, an actively exploited SQL injection flaw in on-premises VeloCloud Orchestrator (VCO). The company says an authenticated user with as little as the Enterprise Read Only role can gain operator privileges and access internal functionality; hosted and Dedicated deployments have also been patched.
Bottom line — Arista rates the flaw 9.9 out of 10; affected on-premises systems should be upgraded to fixed releases.
Go deeper 4
-
Arista says an attacker needs network access to the VCO web interface and a valid authenticated session; no user interaction is required.
-
Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12; earlier releases in those trains are affected.
-
Arista advises restricting VCO web access to administrative networks and reviewing logs for unusual paths, encoded characters, internal-service references or high request rates.
-
If compromise is suspected, Arista advises preserving application, system, database and web-access logs, plus relevant file-system timestamps, before remediation.