Arista fixes VeloCloud Orchestrator zero-day exploited in attacks
Arista confirms exploitation of CVE-2026-114625 in VeloCloud Orchestrator. The flaw requires an authenticated session but can elevate the privileges of users with limited permissions.
News summary
On 22 October, BleepingComputer reported a SQL injection flaw in VeloCloud Orchestrator, identified as CVE-2026-114625. Arista reported active exploitation. An attacker needs access to the web interface and a valid session; even a low-privileged user can obtain operator permissions and impersonate a local superuser operator.
The fixed versions are 5.2.3.18, 6.1.3.10 and 6.4.2.12. According to the published information, hosted installations had already received the fix, while customers with self-hosted deployments needed to update. The distinction matters for multi-site businesses and providers managing SD-WAN: they need to know who actually maintains the orchestrator.
Source: BleepingComputer — 22 October 2026
What to review in your business
Confirm whether the deployment is hosted or self-hosted and verify its version. A service contract is no substitute for checking that the affected component has been patched.
Review operator activity and interface access logs. The authentication requirement does not make the flaw harmless if compromised or low-trust accounts exist.
Concepts mentioned in this article: Cloud
At Seintec, we help you review affected systems and prioritise protective measures based on your environment. Contact our team.
Contact SeintecRelated service
Cybersecurity
We shield your business so it never stops.