Arista VCO Attacks Call for Investigation
An ordinary tenant account can be enough to take over an affected VeloCloud Orchestrator. Arista’s 22 October advisory confirms active exploitation of CVE-2026-114625, a SQL-injection flaw that lets authenticated users obtain operator privileges.
The least privileged account, Enterprise Read Only, meets the authentication requirement; an attacker also needs a route to the portal. The first corrected builds are 5.2.3.18, 6.1.3.10 and 6.4.2.12 in their respective branches. Versions outside support were not assessed, so their absence from that list is no assurance of safety.
Hosted services, including dedicated deployments, also needed fixes; the vendor reports their rollout complete. Customers operating their own installation still need its update. Restricting management access reduces reachability; the vendor lists no setting that eliminates the defect.
CISA added the issue on 23 October and flags forensic triage. Retain service, host and database records plus file times before remediation when practical. A corrected build and an investigation of prior access answer different questions.
