Attackers Exploit Third Arista VCO Zero-Day in Four Months

Overview

Arista has patched CVE-2026-114625, a critical SQL injection flaw (CVSS 9.9) in VeloCloud Orchestrator (VCO) that attackers are already exploiting. It is the third exploited VCO zero-day patched in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.

Technical Details

According to Arista, any authenticated user on an affected system can reach privileged internal functionality and gain operator privileges, masquerading as a local "superuser operator". Exploitation needs access to the VCO web interface and a valid session holding the lowest built-in tenant role.

VCO deployments are exposed by default, and Arista says no configuration prevents the exposure. Successful exploitation affects the confidentiality, integrity, and availability of VCO and the data it manages.

Affected and Fixed Versions

All releases before these are vulnerable. Arista has already patched hosted VCO deployments, so on-premises customers carry the remaining risk.

Indicators

Arista reported attack traffic from 74.82.197.86 and 38.54.50.151.

Recommendations

1. Upgrade on-premises VCO to a fixed release immediately.
2. Restrict VCO web interface access to management networks.
3. Block the two attacking IP addresses and review recent administrator activity.
4. Block unnecessary outbound ports and hunt for backdoor daemons and web shells.
5. If compromise is suspected, preserve web, application, system, and database logs and file-system timestamps before remediation.

Sources

• SecurityWeek — Attackers Exploit Third Arista VCO Zero-Day in Four Months