Arista detailed a zero-day vulnerability in VeloCloud Orchestrator (CVE-2026-114625, CVSS 9.9) where a read-only account can elevate to operator privileges.
Upgrades are available for on-premises deployments.
How the problem works
The issue allows anyone with a simple customer account with read-only permissions to gain full administrative privileges on the system. To succeed, attackers would need access to the web-based administration page and a valid login password.
Who is affected and what needs to be done?
The company said that those who manage the system in their own infrastructures should update their software to versions 5.2.3.18, 6.1.3.10 and 6.4.2.12. Services hosted directly by Arista have already been patched, while devices and local network connections are not affected.
Because the attacks are ongoing, the company recommends restricting access to the administration page, monitoring connections for suspicious activity, and checking logs. In this context, two web addresses that have been identified as carrying out attacks have been made public: 74.82.197.86 and 38.54.50.151.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
