Threat AdvisoriesArista

Arista confirms active exploitation of a VeloCloud management platform vulnerability: prioritise updates

On 22 October, Arista disclosed exploitation of a SQL injection vulnerability in VeloCloud Orchestrator. Even users with low-privilege accounts may gain greater control. Businesses should check their management-platform versions and retain records of suspicious activity.

Anti-Ransomware · Compiled with SI agent assistanceOriginal source publication date: 2026-10-22:Checked 2026.10.26
Original composite illustration of a bakery owner and technician checking network equipment at a branch
Illustration · Source ↗ · About this image ↗

Source Facts

The vendor's CVE-2026-114625 advisory says exploitation requires connectivity to the VeloCloud Orchestrator web interface and a valid login. Even the lowest Enterprise Read Only role may be used to obtain operator privileges.

The vendor lists fixes in 5.2.3.18 for the 5.2 branch, 6.1.3.10 for the 6.1 branch, and 6.4.2.12 for the 6.4 branch. Hosted and Dedicated services have been patched by the vendor. VeloCloud Gateway and Edge are not affected by this vulnerability.

Arista confirms that this vulnerability is being exploited. Before updating, follow vendor guidance to restrict connection sources for management interfaces and check for unusual administrative activity. If compromise is suspected, preserve relevant logs first and have the incident owner coordinate the response.

Next Steps for Businesses / Editorial Observations

Check the management platform version first, then plan patching and incident checks together

Next steps you can take

  • Check VCO branches and fixed versions against the advisory. Ask the vendor about upgrade paths for unsupported releases.
  • Restrict administration interfaces to trusted networks, review logs and unusual privilege escalation, and preserve evidence of suspicious activity.

Original sources

Reporting leads · The Hacker News

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

Security Advisory 0199 — CVE-2026-114625

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxIllustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42Original synthetic illustration of an archive system administrator checking a server maintenance checklistIllustrationThreat Advisories · 2026.10.24

Linux KSMBD file-sharing issue disclosed: first check whether the service is enabled

CSIRT.SK / Sysdig