**Arista Networks** has issued critical security updates to mitigate an actively exploited zero-day vulnerability impacting on-premises deployments of its **VeloCloud Orchestrator (VCO)**. VCO serves as a crucial web-based management portal for configuring, monitoring, and managing **VeloCloud SD-WANs** and associated edge devices. ### Critical Privilege Escalation Flaw The vulnerability, identified as **CVE-2026-114625**, carries a critical severity rating. It enables attackers with basic privileges and a valid authenticated session to the VCO web interface to escalate their access. This is achieved through low-complexity SQL injection attacks that do not require user interaction. According to Arista, successful exploitation could allow a remote attacker to access privileged internal functionality, impacting the VCO host. "Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator," Arista stated. Any authenticated user could potentially gain operator privileges and masquerade as a 'superuser operator,' accessing functionality intended for internal use only. ### Patches and Mitigation Strategies Arista has already deployed patches for its hosted VCO environments running versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later. For on-premises administrators awaiting patch deployment, Arista recommends several mitigation steps: * Monitor for connections originating from known malicious IP addresses. * Restrict access to the VCO web interface solely to administrative networks. * Conduct thorough reviews of recent administrator activity for any unusual or unauthorized changes. * Scrutinize VCO web access logs for suspicious patterns, such as requests with unusual URL path components, encoded characters, references to local or internal services, and abnormally high request rates. ### Indicators of Compromise Arista has specifically warned security teams to block incoming connections from the IP addresses `74.82.197.86` and `38.54.50.151`, which have been observed in ongoing attack campaigns. In the event of suspected compromise, operators are advised to preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before initiating remediation, where operationally feasible. Customers requiring further assistance should contact the **Arista Networks Technical Assistance Center (TAC)**. ### A Pattern of Exploited Zero-Days This is not the first time Arista has had to address actively exploited zero-day vulnerabilities this year. The company previously patched three other critical flaws affecting **Extensible Operating System (EOS)** and on-premises VeloCloud Orchestrator deployments: * **CVE-2026-7473** in May * **CVE-2026-16812** in July * **CVE-2026-93952** in September Arista Networks, a Fortune 500 company with over 10,000 customers globally, continues to be a target for sophisticated threat actors, underscoring the persistent challenges in maintaining robust security postures for critical infrastructure components.