Arista patches actively exploited VeloCloud Orchestrator zero-day

Arista Networks released fixes for a critical zero-day, CVE-2026-114625, in VeloCloud Orchestrator On-Prem deployments that is already being exploited in attacks. The SQL injection lets any authenticated user escalate to operator privileges and impersonate a local superuser.

• CVE-2026-114625 needs only basic privileges and a valid session
• Patches cover versions 5.2.3.18, 6.1.3.10 and 6.4.2.12 and later
• Arista advises blocking IPs 74.82.197.86 and 38.54.50.151
• Fourth actively exploited Arista zero-day patched this year