Arista VeloCloud Zero-Day (CVE-2026-114625) Exploited
Arista Patches Exploited VeloCloud Orchestrator Zero-Day
Related Entities
Organizations
Products & Tech
CVE Identifiers
Full Report
Executive Summary
Arista Networks has issued an urgent security advisory for a critical, actively exploited zero-day vulnerability in its VeloCloud Orchestrator (VCO) on-premises deployments. The vulnerability, tracked as CVE-2026-114625, is a SQL injection flaw that enables any authenticated user to escalate privileges to a superuser level. Attackers are already exploiting this vulnerability in the wild, giving them the ability to take complete control of an organization's SD-WAN fabric. Arista has released patches and provided IOCs, and recommends immediate remediation for all affected customers.
Vulnerability Details
- CVE ID: CVE-2026-114625
- Vulnerability Type: SQL Injection (CWE-89)
- Attack Vector: Network
- Complexity: Low
- Privileges Required: Low (Any authenticated user)
- User Interaction: None
This vulnerability exists in the web-based management portal of the VeloCloud Orchestrator. An attacker who has successfully authenticated to the portal, even with the lowest level of privilege, can send a specially crafted request to trigger a SQL injection. This allows them to bypass authorization checks and elevate their privileges to that of a local superuser (operator) on the orchestrator. This is the fourth actively exploited zero-day patched by Arista in 2026, suggesting sustained interest from threat actors in this high-value target.
Affected Systems
- Product: Arista VeloCloud Orchestrator (VCO) On-Premises Deployments
- Affected Versions: All on-premises versions prior to the patched releases.
- Patched Versions:
5.2.3.18,6.1.3.10,6.4.2.12, and later.
Cloud-hosted instances of VeloCloud Orchestrator managed by Arista are not affected by this vulnerability.
Exploitation Status
Arista has confirmed that CVE-2026-114625 is being actively exploited in the wild. The company has observed attacks originating from specific IP addresses and has shared them as Indicators of Compromise (IOCs). The low complexity and the fact that only low-level authentication is required make this an attractive target for attackers looking to compromise enterprise networks.
Impact Assessment
Successful exploitation of this vulnerability is catastrophic for an organization's network security. The VeloCloud Orchestrator is the central management plane for the entire SD-WAN infrastructure. An attacker with superuser access can:
- Violate Confidentiality: Intercept and decrypt traffic passing through the SD-WAN.
- Violate Integrity: Modify network configurations, redirect traffic to malicious sites, and inject malicious payloads into network streams.
- Violate Availability: Disrupt or completely take down network services across the entire organization, from data centers to branch offices.
In essence, compromising the orchestrator gives an attacker the "keys to the kingdom," providing a powerful pivot point for lateral movement, data exfiltration, and deployment of further attacks like ransomware.
IOCs — Directly from Articles
The source articles explicitly mentioned the following IP addresses as being associated with exploitation attempts:
ip_address_v474.82.197.86ip_address_v438.54.50.151Cyber Observables — Hunting Hints
Security teams can hunt for signs of compromise or vulnerable systems using the following patterns:
- Log Source: VCO system logs, web server access logs (e.g., Nginx, Apache) on the orchestrator.
- URL Patterns: Look for suspicious or malformed requests to the VCO web management portal, especially those containing SQL keywords like
UNION,SELECT,', or--in URL parameters. - Network Traffic: Monitor for connections to or from the orchestrator involving the IOC IP addresses (
74.82.197.86,38.54.50.151). - User Activity: Audit for unexpected privilege escalations or actions performed by low-privileged accounts in the VCO management interface.
Detection Methods
- Log Analysis: Create SIEM alerts for any web requests to the VCO portal that contain common SQL injection patterns. Correlate web access logs with process execution logs on the orchestrator to look for unusual child processes spawned by the web server.
- Network Monitoring: Implement firewall rules to block all traffic from the known malicious IPs. Use network intrusion detection systems (NIDS) with signatures for SQL injection to monitor traffic to the VCO management interface.
- D3FEND Techniques: Use
D3-NTA - Network Traffic Analysisto baseline normal traffic to the VCO and alert on anomalous connections or data flows. - Vulnerability Scanning: Use authenticated scans to check the version of on-premises VCO instances to identify unpatched systems.
Remediation Steps
- Patch Immediately: The primary remediation is to upgrade all on-premises VeloCloud Orchestrator instances to a patched version (
5.2.3.18,6.1.3.10,6.4.2.12, or later) as soon as possible. - Restrict Access (Workaround): If patching cannot be done immediately, restrict access to the VCO web management interface to a limited set of trusted IP addresses on a secure administrative network. This is a temporary measure and does not replace patching.
- Block Malicious IPs: Add the IOC IP addresses (
74.82.197.86,38.54.50.151) to your network firewall blocklist. - Hunt for Compromise: After patching, review logs for any signs of exploitation that may have occurred before the patch was applied. If compromise is suspected, assume the entire SD-WAN fabric is compromised and initiate incident response procedures.
Timeline of Events
MITRE ATT&CK Mitigations
The most effective mitigation is to apply the security patches provided by Arista immediately.
As a temporary workaround, restrict network access to the VeloCloud Orchestrator's management interface to only trusted administrative hosts.
Run web applications like the VCO portal in a sandboxed environment with limited privileges to contain the impact of a potential compromise.
Use a Web Application Firewall (WAF) to inspect traffic to the management portal and block malicious requests, such as those containing SQL injection patterns.
D3FEND Defensive Countermeasures
The primary and most critical action is to apply the patches released by Arista Networks. Given this is an actively exploited zero-day, patching should be treated as an emergency change. Organizations should immediately identify all on-premises VeloCloud Orchestrator instances and upgrade them to a secure version (5.2.3.18, 6.1.3.10, 6.4.2.12, or later). Change management processes should be expedited to approve and deploy this update. After patching, it is essential to verify the update was successful across all instances. This countermeasure directly removes the vulnerability, preventing both known and unknown attackers from exploiting CVE-2026-114625 to gain control of the SD-WAN infrastructure. Failure to patch guarantees continued exposure to a known, critical threat.
Implement strict inbound traffic filtering for the VeloCloud Orchestrator's management interface. First, create and apply a firewall rule to deny all traffic from the known malicious IPs: 74.82.197.86 and 38.54.50.151. More strategically, the management interface should never be exposed to the public internet. Access should be restricted via an allowlist to a small set of trusted IP addresses, such as those from a dedicated management subnet or a secure administrative jump host. This serves as a critical compensating control if immediate patching is not feasible and significantly reduces the attack surface by preventing unauthorized external actors from even reaching the vulnerable login page. A Web Application Firewall (WAF) can also be deployed in front of the VCO to inspect for and block SQL injection patterns in web requests.
Configure detailed logging and alerting for account activity on the VeloCloud Orchestrator. Specifically, monitor for the creation of new administrative accounts or unexpected privilege escalation events. Since the exploit allows a low-privileged user to become a superuser, an alert should trigger if an account suddenly gains 'operator' privileges without going through a standard approval workflow. Forward VCO audit logs to a centralized SIEM to correlate login activity with subsequent actions. An alert on 'privilege escalation for user X' or 'new admin account created by user Y' could be the first sign of a successful compromise, enabling a rapid incident response before the attacker can pivot and cause further damage.
Timeline of Events
Arista Networks releases patches and discloses the active exploitation of CVE-2026-114625.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.