Arista Networks VeloCloud Orchestrator (VCO) On-Prem o'rnatmalariga ta'sir qiluvchi faol foydalanilayotgan zero-day zaifligini tuzatish uchun xavfsizlik yangilanishlarini e'lon qildi.
VCO — bu veb-asosli boshqaruv portali bo'lib, administratorlarga VeloCloud SD-WAN (Dasturiy ta'minot bilan aniqlangan keng maydon tarmoqlari) va ular bilan bog'liq chekka qurilmalarni sozlash, kuzatish va boshqarishda yordam beradi.
CVE-2026-114625 sifatida kuzatilgan bu muhim darajadagi zaiflik asosiy huquqlarga ega bo'lgan, VCO veb-interfeysiga kirish huquqiga ega bo'lgan va haqiqiy autentifikatsiyalangan sessiyaga ega bo'lgan hujumchilarga foydalanuvchi o'zaro ta'sirini talab qilmaydigan past murakkablikdagi SQL in'ektsiya hujumlari orqali huquqlarni oshirishga imkon beradi.
"VeloCloud Orchestrator (VCO) on-prem tizimida xavfsizlik muammosi mavjud bo'lib, bu muammo masofaviy hujumchiga imtiyozli ichki funksionallikka kirish va VCO xostiga ta'sir qilish imkonini berishi mumkin. Muvaffaqiyatli foydalanish orkestrator va orkestrator tomonidan boshqariladigan ma'lumotlarning maxfiyligi, yaxlitligi va mavjudligini buzishi mumkin", — dedi Arista.
"Ta'sirlangan tizimda har qanday autentifikatsiyalangan foydalanuvchi operator huquqlarini qo'lga kiritishi va mahalliy 'superuser operator' foydalanuvchisi sifatida niqoblanishi mumkin. Bu faqat ichki foydalanish uchun mo'ljallangan va masofadan foydalanish uchun mo'ljallanmagan funksionallikka kirishni o'z ichiga oladi."
Kompaniya 5.2.3.18 yoki undan yuqori, 6.1.3.10 yoki undan yuqori va 6.4.2.12 yoki undan yuqori versiyalarda ishlaydigan joylashtirilgan VCO o'rnatmalarini allaqachon tuzatganini aytdi.
Yamoqlar o'rnatilguncha, Arista administratorlarga ma'lum zararli IP manzillardan keladigan ulanishlarni kuzatishni, VCO veb-interfeysiga kirishni ma'muriy tarmoqlarga cheklashni va so'nggi administrator faoliyatini g'ayrioddiy o'zgarishlar uchun tekshirishni tavsiya qildi.
Administratorlarga shuningdek, VCO veb-kirish jurnallarini shubhali faoliyat, masalan, g'ayrioddiy URL-ga o'xshash yo'l komponentlari, kodlangan belgilar, mahalliy yoki ichki xizmatlarga havolalar va yuqori so'rov tezligi kabi holatlar uchun tekshirish tavsiya etiladi.
Kompaniya shuningdek, xavfsizlik jamoalariga davom etayotgan hujumlar davomida kuzatilgan 74[.]82.197.86 va 38[.]54.50.151 IP manzillarini bloklashni ogohlantirdi.
"Agar buzilish shubha qilinsa, operatorlar operatsion jihatdan mumkin bo'lgan hollarda tuzatishdan oldin VCO veb-kirish jurnallarini, orqa fon ilova jurnallarini, tizim jurnallarini, ma'lumotlar bazasi jurnallarini va tegishli fayl tizimi vaqt belgilarini saqlab qolishlari kerak", — deb ta'kidlandi va mijozlarga qo'shimcha yordam uchun Arista Networks Texnik Yordam Markaziga (TAC) murojaat qilish tavsiya etildi.
Bu yil Arista Extensible Operating System (EOS) va on-premises VeloCloud Orchestrator o'rnatmalariga ta'sir qiluvchi uchta boshqa faol foydalanilayotgan zero-day zaifligini (may oyida CVE-2026-7473, iyulda CVE-2026-16812 va sentyabrda CVE-2026-93952) tuzatdi.
Arista Networks Fortune 500 kompaniyasi va daromad bo'yicha AQShning eng yirik korporatsiyalaridan biri bo'lib, butun dunyo bo'ylab 10 000 dan ortiq mijozga ega.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika bo'yicha mudofaa choralarini o'lchaydi.
Hisobotni oling
Tegishli maqolalar:
Arista faol foydalanilayotgan VeloCloud Orchestrator zero-day zaifligini tuzatdi
F5 BIG-IP APM zero-day zaifligini RCE hujumlarida foydalanilganini tuzatdi
Magento StyleSmuggler zero-day Linux backdoor o'rnatish uchun foydalanildi
PaperCut foydalanilgan zaifliklar uchun ikkinchi favqulodda yamoqni e'lon qildi
PaperCut NG, MF zaifligi zero-day hujumlarida foydalanilayotgani haqida ogohlantirdi
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
By Sergiu Gatlan
October 22, 2026
01:18 PM
0
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments.
VCO is a web-based management portal that helps administrators configure, monitor, and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices.
Tracked as CVE-2026-114625, this critical-severity flaw can allow attackers with basic privileges, access to the VCO web interface, and a valid authenticated session to escalate privileges through low-complexity SQL injection attacks that don't require user interaction.
"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator," Arista said.
"On an affected system, any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible."
The company said it has already patched hosted VCO deployments running version 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later.
Until the patches are deployed, Arista advised admins to monitor for connections from known malicious IP addresses, restrict access to the VCO web interface to administrative networks, and review recent administrator activity for unusual changes.
Admins are also recommended to review VCO web access logs for suspicious activity, such as requests with unusual URL-like path components, encoded characters, references to local or internal services, and high request rates.
The company also warned security teams to block the 74[.]82.197.86 and 38[.]54.50.151 IP addresses, which have been observed during ongoing attacks.
"If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible," it noted, advising customers to contact the Arista Networks Technical Assistance Center (TAC) for additional assistance.
This year, Arista has patched three other actively exploited zero-day flaws (CVE-2026-7473 in May, CVE-2026-16812in July, and CVE-2026-93952 in September) affecting Extensible Operating System (EOS) and on-premises VeloCloud Orchestrator deployments.
Arista Networks is a Fortune 500 company and one of the largest US corporations by revenue, with over 10,000 customers worldwide.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
Related Articles:
Arista patches actively exploited VeloCloud Orchestrator zero-day
F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks
Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
PaperCut releases second emergency patch for exploited flaws
PaperCut warns of NG, MF flaw exploited in zero-day attacks