CriticalZero-Day
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
The Hacker News·Source published ·1 min read
What happened?
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For
Key details
- Attackers are exploiting a zero-day SQL injection flaw in Arista VeloCloud Orchestrator (VCO).
- Any authenticated user, even with read-only role, can gain operator privileges.
- The vulnerability is tracked as CVE-2026-114625 with CVSS 9.9 rating.
- Exploitation requires network access to VCO web interface and a valid login.
- This is the third exploited VCO flaw since July, first requiring authentication.
- VeloCloud Gateway and Edge devices are not affected by this flaw.
- Arista has not determined if upgrading removes attacker access already gained.
Fixes and mitigations
- Hosted and Dedicated orchestrators already patched by Arista.
- Monitor VCO for connections from known malicious IP addresses.
- Consider blocking outbound ports not needed for normal operation.
What to look for
- Unusual URL-like path components in VCO web access logs.
- References to local or internal services in log requests.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.