Arista Networks released security updates to address a zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments, which were actively exploited in attacks.
The vulnerability or weakness
The vulnerability, tracked as CVE-2026-114625, is a critical-severity flaw allowing attackers to escalate privileges through SQL injection attacks without requiring user interaction.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-114625 | 9.4 | CRITICAL | No | - |
| CVE-2026-7473 | 6.9 | MEDIUM | Yes, added 2026-06-09 | 2026-06-23 |
| CVE-2026-93952 | 9.5 | CRITICAL | Yes, added 2026-09-22 | 2026-09-25 |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
This can lead to unauthorized access to sensitive data and functionalities, compromising the confidentiality, integrity, and availability of the VCO and associated SD-WANs, potentially resulting in significant operational and financial impacts.
Industries affected
This affects organizations that use VCO On-Prem deployments, including enterprises and service providers utilizing VeloCloud SD-WAN solutions.
Users affected
Administrators and users are advised to monitor for suspicious activities, restrict access, and review recent administrator activities for any unusual changes.
Build these skills
Watch the daily brief
Sources
- Arista patches new VeloCloud Orchestrator zero-day exploited in attacks (BleepingComputer)
