Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

{"heading_1":"VeloCloud Orchestrator Vulnerability Details","heading_2":"Vulnerability Description","heading_3":"Vulnerability Impact","paragraph_1":"VeloCloud Orchestrator (VCO) is a web-based management portal used by administrators to configure, monitor, and manage VeloCloud SD-WANs and associated edge devices. The vulnerability, tracked as CVE-2026-114625, affects On-Prem deployments of VCO.","paragraph_2":"The vulnerability allows attackers with basic privileges, access to the VCO web interface, and a valid authenticated session to escalate privileges through low-complexity SQL injection attacks that do not require user interaction.","paragraph_3":"The vulnerability can be exploited to gain operator privileges and masquerade as a local 'superuser operator' user, which includes access to functionality intended for internal use only and not intended to be remotely accessible.","paragraph_4":"The vulnerability can also be exploited to access privileged internal functionality and impact the VCO host, compromising the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","paragraph_5":"The vulnerability can be exploited by attackers with valid credentials, and once attackers are using valid credentials, prevention drops sharply, making it crucial to patch the vulnerability to prevent unauthorized access.","paragraph_6":"Arista Networks has already patched hosted VCO deployments running version 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later. Admins are advised to monitor for connections from known malicious IP addresses, restrict access to the VCO web interface to administrative networks, and review recent administrator activity for unusual changes.","paragraph_7":"Arista Networks also warned security teams to block the IP addresses 74.82.197.86 and 38.54.50.151, which have been observed during ongoing attacks. The company advised customers to contact the Arista Networks Technical Assistance Center (TAC) for additional assistance.","paragraph_8":"This vulnerability is part of a series of actively exploited zero-day flaws that Arista Networks has patched in the past, including CVE-2026-7473 in May, CVE-2026-16812 in July, and CVE-2026-93952 in September. The company is a Fortune 500 company and one of the largest US corporations by revenue, with over 10,000 customers worldwide.","paragraph_9":"The vulnerability is a critical security risk that could allow attackers to gain unauthorized access to the system, and it is important to patch the vulnerability to prevent potential damage and data breaches.","paragraph_10":"The vulnerability is a critical security risk that could allow attackers to gain unauthorized access to the system, and it is important to patch the vulnerability to prevent potential damage and data breaches."}