Arista patches VeloCloud Orchestrator zero-day

Arista Networks said it had released security updates for an actively exploited flaw in VeloCloud Orchestrator (VCO) On-Prem. It identified the issue as CVE-2026-114625 and described VCO as the web portal used to manage VeloCloud SD-WANs and edge devices.

The company said the bug affected users with basic privileges, access to the web interface and a valid session. In its notice, Arista said successful exploitation could reach internal functions and harm the orchestrator and the information it handled.

Arista said hosted VCO deployments running version 5.2.3.18 or later, 6.1.3.10 or later and 6.4.2.12 or later had already been patched. Before fixes were installed, it told administrators to limit access from administrative networks, review recent activity and inspect web logs for suspicious requests.

The company also named 74[.]82.197.86 and 38[.]54.50.151 as addresses seen in the attacks, and it asked customers to preserve logs and timestamps if they suspected compromise. It said to contact the Arista Networks Technical Assistance Center for further help, and noted that it had already patched three other actively exploited zero-days earlier in the year.