Arista Networks has released updates for a zero-day vulnerability in on-premises VeloCloud Orchestrator deployments that attackers are already exploiting. The flaw, tracked as CVE-2026-114625, lets any authenticated user gain superuser operator privileges through SQL injection. Hosted deployments have already been patched, and for on-premises systems the company advises restricting access to the web interface, reviewing logs and blocking two IP addresses seen in the attacks. It is the fourth actively exploited vulnerability in Arista products this year.

What it means: VeloCloud Orchestrator is the central point from which a company configures the SD-WAN that links its shops, warehouses and offices. Whoever controls the orchestrator can in principle change routing, cut off branches or open a path to internal systems. For Greek retail chains, banks and service providers that manage SD-WAN for customers, the update needs to go into the schedule now, especially because the attack only requires an ordinary user account. In other words, a stolen low-privilege password is enough to become an administrator. Until the fix is installed, limiting access to the management interface to administrative networks is the most effective step. The fact that this is the fourth such case this year shows that network management devices and platforms have become a favoured target, because they often sit outside day-to-day security monitoring. For organisations under NIS2, preserving logs before remediation, as the vendor suggests, helps both the investigation and the documentation an incident report may require.

Read the original on BleepingComputer

Related service: Custom software

Related stories