Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. VCO is a web-based management portal that helps administrators configure, monitor, and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices. Tracked as CVE-2026-114625, this critical-severity flaw can allow attackers with basic privileges, access to the VCO web interface, and a valid authenticated session to escalate privileges through low-complexity SQL injection attacks that don't require user interaction.

Published 22-Oct-2026 17:42 UTC · First seen 22-Oct-2026 17:42 UTC

Sources

• BleepingComputer · 22-Oct-2026