Arista Warns of Actively Exploited VeloCloud Orchestrator Zero-Day With CVSS 9.9
Arista Networks has disclosed an actively exploited zero-day SQL injection vulnerability in its VeloCloud Orchestrator (VCO), the central management platform for VeloCloud software-defined wide area network (SD-WAN) deployments. Tracked as CVE-2026-114625, the vulnerability carries a critical CVSS score of 9.9 out of 10 and can allow an authenticated user with limited permissions to gain operator-level privileges.
In a security advisory published on October 22, 2026, Arista warned that attackers are exploiting the flaw. The company has released fixes for affected on-premises deployments, while Hosted and Dedicated Orchestrator environments have already been patched.
The vulnerability is particularly concerning because an attacker does not need an administrator account. A valid account with the Enterprise Read Only role, the lowest built-in customer role, is sufficient to exploit the issue if the attacker can access the orchestrator's web interface.
SQL Injection Flaw Enables Privilege Escalation
VeloCloud Orchestrator manages customer and partner accounts across SD-WAN environments. Operators use the platform to create and administer accounts, while partners can manage groups of customers.
According to Arista, CVE-2026-114625 allows an authenticated attacker to escalate privileges to the local superuser level, providing extensive control over the orchestrator.
Depending on the impact of a successful compromise, attackers may be able to expose or modify sensitive information, disrupt management operations, and potentially affect the underlying VCO host and the data it manages.
The advisory requires network access to the VCO web interface and a valid login. Arista also states that the orchestrator is exposed by default and that no VCO configuration setting prevents the exposure.
The company has not disclosed when exploitation began, how many systems have been compromised, or what attackers have done after gaining access.
Affected Versions and Available Fixes
Arista has published fixed releases for three affected VCO release trains. Administrators running on-premises deployments should upgrade to the applicable fixed version or a later release within the relevant train.
Release trainAffected versionsFixed version5.2Versions before 5.2.3.185.2.3.18 and later6.1Versions before 6.1.3.106.1.3.10 and later6.4Versions before 6.4.2.126.4.2.12 and later
Hosted and Dedicated Orchestrator deployments have already received patches, according to Arista.
The company states that VeloCloud Gateway and VeloCloud Edge are not affected by this vulnerability. The 7.0 release train is also absent from the affected-version list, and Arista says releases not listed in its advisory are not vulnerable.
However, releases that have reached end of support were not assessed. Customers running unsupported release trains should contact Arista's Technical Assistance Center for guidance on upgrade options.
Third Exploited VeloCloud Orchestrator Vulnerability Since July
CVE-2026-114625 is the third VCO vulnerability Arista has reported as exploited since late July 2026.
The earlier vulnerabilities were:
- CVE-2026-16812: Disclosed in July 2026. The vulnerability did not require authentication.
- CVE-2026-93952: Disclosed in September 2026. This flaw also did not require authentication.
- CVE-2026-114625: Disclosed in October 2026. Unlike the previous two flaws, exploitation requires a valid account, although a read-only customer account is sufficient.
The September vulnerability was fixed in VCO 5.2.3.16 and 6.4.2.8, according to Arista's advisory. The company has not listed a fixed release for that flaw in the 6.1 train, where versions through 6.1.3.7 were reported as affected.
The available advisories do not clarify whether VCO 6.1.3.10 also addresses the September vulnerability. Administrators should therefore verify the status of both issues with Arista rather than assuming that installing the latest fix for CVE-2026-114625 resolves every previously disclosed vulnerability.
Arista acquired the VeloCloud SD-WAN product line from Broadcom in a deal announced in July 2025. The product was previously marketed as VMware SD-WAN by VeloCloud.
Mitigation Steps Before Upgrading
Organizations that cannot immediately install a fixed release should restrict access to the VCO web interface and closely monitor the orchestrator for suspicious activity.
Arista recommends the following defensive measures:
- Restrict administrative access: Allow connections to the VCO web interface only from trusted administrative networks.
- Monitor suspicious IP addresses: Review network and application logs for connections associated with known attack infrastructure.
- Inspect outbound traffic: Investigate unexpected connections originating from the VCO host.
- Restrict unnecessary outbound ports: Block outbound traffic that is not required for normal orchestrator operations.
- Search for persistence mechanisms: Check for suspicious background daemons, webshells, and other unexpected system changes.
- Audit administrator activity: Review recent account usage, privilege changes, configuration modifications, and other unusual administrative actions.
These measures can reduce exposure while an upgrade is being prepared, but they do not eliminate the underlying vulnerability.
Indicators of Compromise
Arista identified two IP addresses associated with the observed attacks:
74.82.197[.]8638.54.50[.]151
Security teams should consider blocking these addresses where appropriate and checking existing logs for related activity.
Administrators should also examine VCO web access logs for unusual URL-like path components, encoded characters, references to local or internal services, and unexpectedly high request rates. These patterns may help identify suspicious requests, although their presence alone does not prove that a system has been compromised.
If a compromise is suspected, organizations should preserve relevant evidence before making changes wherever possible. Useful evidence includes web access logs, backend application logs, system and database logs, and relevant filesystem timestamps.
Potential Risk to Managed SD-WAN Environments
Arista previously warned that compromises involving the July and September VCO vulnerabilities could provide attackers with access to VeloCloud Edge devices.
For CVE-2026-114625, the company has not explicitly confirmed whether the same downstream risk applies or whether upgrading removes access an attacker may already have obtained.
Organizations should therefore treat a suspected orchestrator compromise as a potential wider infrastructure incident. Applying the software update is essential, but it should be accompanied by an investigation into unauthorized access, unexpected configuration changes, and possible persistence.
Security recommendation: Administrators should prioritize upgrading affected VeloCloud Orchestrator deployments to the appropriate fixed release, verify their exposure to previously disclosed VCO vulnerabilities, and investigate suspicious activity that may have occurred before patching.
