Security AlertCritical
Arista patches exploited VeloCloud Orchestrator zero-day
Oct 23, 2026 · Summarized by Fundy Tech from 2 sources
The 30-second version
Arista has patched a critical VeloCloud Orchestrator vulnerability that was being exploited as a zero-day. The company says on-premises users should update to a fixed release as soon as possible.
Key points
- The flaw is CVE-2026-114625.
- Arista says the issue is actively exploited.
- Affected releases are before 5.2.3.18, 6.1.3.10, and 6.4.2.12.
Why it matters
If your organisation uses VeloCloud Orchestrator, this needs prompt attention. Exploited zero-days can expose management systems and the data they control.
Who’s affected: VeloCloud Orchestrator on-premises deployments
What to do
- Update to a fixed VCO release.
- Restrict access to the VCO interface.
- Review logs for suspicious activity.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.