Hackers Actively Exploiting Critical VeloCloud Orchestrator Flaw to Gain Superuser Access

Hackers are actively exploiting a critical SQL injection flaw in VeloCloud Orchestrator (VCO) that allows logged-in users to gain superuser operator access.

Arista Networks disclosed the vulnerability on October 22, 2026, warning that successful attacks could compromise the orchestrator, its host, and the data it manages. Arista has already patched hosted deployments, including Dedicated instances.

Tracked as CVE-2026-114625, the vulnerability carries a CVSS v3.1 score of 9.9 and a CVSS v4.0 score of 9.4. Arista discovered the issue and confirmed active exploitation.

Security Advisory 0199 identifies the weakness as CWE-89 (SQL injection) and tracks it internally as BUG2043622. Exploitation requires network access to the VCO web interface and a valid authenticated portal session. However, attackers do not need an administrator account.

Enterprise Read Only, the lowest built-in tenant role, provides enough access to exploit the flaw. The attack requires no user interaction and is low complexity.

A successful attacker can gain operator privileges and impersonate a local “superuser operator” account. This opens access to internal functions that should not be available remotely.

Arista warns that exploitation can affect the confidentiality, integrity, and availability of both the orchestrator and its managed data.

The login requirement is important. This is not an unauthenticated attack, but a limited account can become a route to much broader control.

Hackers Exploiting VeloCloud Orchestrator Flaw

Arista says VCO is exposed by default and no product configuration removes the exposure. Restricting network access is a temporary safeguard, not a fix. The disclosure follows earlier VeloCloud Orchestrator exploitation involving a separate command injection vulnerability.

Another related report covered SonicWall SQL injection flaws that could turn read-only access into administrator control. Those cases involve different vulnerabilities and should not be confused with this issue.

Affected on-premises deployments include VCO 5.2.x releases before 5.2.3.18, VCO 6.1.x releases before 6.1.3.10, and VCO 6.4.x releases before 6.4.2.12. Administrators should upgrade to the fixed version in their release train or a later release. Arista has not assessed software that has reached end of support.

VeloCloud Gateway and VeloCloud Edge are not affected. Arista also lists its EOS-based products and other named platforms as unaffected. Operators should check the affected software list first instead of assuming that every Arista or VeloCloud product needs the same update.

Arista identified 74.82.197.86 and 38.54.50.151 as source IP addresses observed conducting attacks. Security teams should block these addresses and search historical logs for related activity.

Investigators should also examine unusual URL-like paths, encoded characters, references to local or internal services, and unusually high request rates.

Where feasible, teams should preserve web access, backend application, system, and database logs, along with relevant file timestamps, before remediation.

Arista also recommends restricting web access to trusted administrative networks, checking unexpected outbound connections, reviewing administrator changes, and monitoring for backdoor services or webshells.

Customers outside supported release trains should contact Arista Technical Assistance Center about upgrade options. These interim controls reduce exposure, but installing a fixed release remains the recommended resolution.

Because exploitation is already confirmed, affected organizations should prioritize patching alongside a review for signs of compromise rather than treating the upgrade as routine maintenance.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Actively Exploiting Critical VeloCloud Orchestrator Flaw to Gain Superuser Access appeared first on Cyber Security News.