Arista Networks has released immediate security updates to address a severe zero-day vulnerability being successfully exploited in active cyberattacks against on-premises deployments of the VeloCloud Orchestrator management platform, which specializes in Software-Defined Wide Area Network (SD-WAN) management.
Vulnerability Details and Exploitation
The vulnerability, tracked as CVE-2026-114625, carries a critical severity rating and allows attackers who possess basic privileges and access to the platform's web interface with a valid authentication session to escalate their privileges via low-complexity SQL injection attacks without requiring any user interaction.
According to technical data released by the company, any authenticated user on an affected system can gain operator privileges and masquerade as a local super-privileged user, granting them unauthorized access to sensitive internal functions that compromise the confidentiality, integrity, and availability of the system and managed data.
Preventive Measures and Fixes
Arista has provided software fixes for hosted versions and those running versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later. Until the updates are fully applied, the company has recommended that system administrators take a set of urgent preventive measures:
- Monitor communications coming from known malicious IP addresses, specifically 74.82.197.86 and 38.54.50.151, which were observed in current attacks.
- Restrict access to the platform's web interface, limiting it to internal management networks only.
- Review administrator activity logs and access logs for any unusual activities, such as requests with unusual URL-like paths, encrypted payloads, or high request rates.
- Preserve web, application, system, database logs, and system files before initiating remediation processes for forensic investigation if a breach is suspected.
Notably, this security release represents a new link in a series of active zero-day vulnerabilities addressed by the company this year, which included releases of the Extensible Operating System (EOS) and on-premises VeloCloud deployments in May, July, and September.