Arista Networks has released critical security updates to address an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator on-premises deployments, according to a recent report by Bleeping Computer.
The vulnerability, tracked as CVE-2026-114625, resides in the VeloCloud Orchestrator web-based management portal. It allows authenticated users with basic privileges to escalate their access to superuser status through low-complexity SQL injection attacks. Successful exploitation grants attackers access to privileged internal functions, potentially compromising the confidentiality and integrity of the orchestrator and its managed data. Arista has issued patches for versions 5.2.3.18, 6.1.3.10, 6.4.2.12 and later. Until updates are applied, the company recommends restricting web interface access to administrative networks and monitoring logs for suspicious activity. Security teams should specifically block traffic from IP addresses 74.82.197.86 and 38.54.50.151, which have been linked to ongoing exploitation attempts. This incident marks the fourth actively exploited zero-day flaw patched by Arista this year, highlighting persistent threats to its Extensible Operating System and VeloCloud infrastructure. Arista serves over 10,000 customers globally, making the security of these management portals a significant priority for enterprise network administrators.
