Hackers Actively Exploiting Critical VeloCloud Orchestrator Flaw to Gain Superuser Access

What happened?

Hackers are actively exploiting a critical SQL injection flaw in VeloCloud Orchestrator (VCO) that allows logged-in users to gain superuser operator access. Arista Networks disclosed the vulnerability on October 22, 2026, warning that successful attacks could compromise the orchestrator, its host, and the data it manages. Arista has already patched hosted deployments, including Dedicated instances. Tracked as CVE-2026-114625, the vulnerability carries a CVSS v3.1 score of 9.9 and a CVSS v4.0 score of 9.4. Arista discovered the issue and confirmed active exploitation.

Key details

• Critical SQL injection flaw in VCO allows logged-in users to gain superuser operator access.
• Exploitation requires network access to VCO web interface and a valid authenticated portal session.
• Enterprise Read Only tenant role is sufficient to exploit the SQL injection flaw.
• Successful attacker can gain operator privileges and impersonate a local superuser operator account.
• Arista has patched hosted deployments including Dedicated instances following disclosure on October 22, 2026.
• Affected on-premises versions are VCO 5.2.x before 5.2.3.18, VCO 6.1.x before 6.1.3.10, and VCO 6.4.x before 6.4.2.12.
• Arista identified source IPs 74.82.197.86 and 38.54.50.151 conducting attacks, recommend blocking them.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.