Third Arista VCO Zero-Day Exploited in Four Months via SQL Injection
Repeated zero-day exploitation of Arista VCO reveals a sustained campaign against SD-WAN management layers. Technical indicators show SQL injection for privilege escalation from minimal credentials, with no attribution beyond two IPs. The pattern demands immediate log preservation and network segmentation rather than reliance on vendor patch cadence alone.
Arista's advisory supplies no actor attribution, only the two source IPs and indicators. Independent verification would require correlating those addresses against known infrastructure in public sinkhole data or prior campaign reporting. Until such linkage appears, the technical evidence shows repeated remote code-adjacent access to a centralized controller, not state sponsorship. Operators must treat every VCO instance as potentially pre-compromised until logs are exhaustively reviewed post-upgrade.
Mandiant: Within 60 days, at least one additional VCO compromise chain using similar SQLi will be disclosed with infrastructure overlap to the two listed IPs.
Sources (3)
- [1]Primary Source(https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/)
- [2]Arista Security Advisory(https://www.arista.com/en/support/advisories-notices)
- [3]NVD CVE-2026-114625(https://nvd.nist.gov/vuln/detail/CVE-2026-114625)