Critical SQL Injection Flaw in Arista VCO Already Exploited in Attacks
Arista Networks disclosed a critical SQL injection vulnerability in its VeloCloud Orchestrator product used for SD-WAN network management. The flaw, tracked as CVE-2026-114625, carries a CVSS v4.0 base score of 9.4 and a CVSS v3.1 score of 9.9, placing it in the highest severity category. Exploitation requires network access to the management interface and an authenticated session with Enterprise Read Only privileges or higher, after which attackers can escalate rights to reach internal management functions and compromise managed systems and data. The vendor has already observed active exploitation of the issue in the wild. Patches are available in versions 6.4.2.12, 6.1.3.10, and 5.2.3.18, and customers are urged to apply the updates immediately.
Security NEXTOct 26, 2026Translated from Japanese