Arista fixes third actively exploited VeloCloud flaw in three months

On October 22, 2026, Arista Networks fixed a VeloCloud Orchestrator zero-day vulnerability that attackers had already exploited. The vulnerability puts businesses at risk because it affects the system used to handle network connections across multiple sites. How a read-only account becomes a superuser Advisory 0199 of Arista identifies the vulnerability as CVE-2026-114625, an SQL-injection vulnerability rated 9.9 under CVSS v3.1. The danger lies in how much control an attacker can gain, even with the lowest level of access. To take advantage of the vulnerability, an attacker needs access to the web interface and valid login credentials. Once logged-in, the attacker can use the SQL-injection vulnerability to elevate an Enterprise Read Only account, the platform’s lowest-privilege role, to operator privileges and impersonate a superuser.