VeloCloud Orchestrator is the web console that configures every branch router in a VeloCloud SD-WAN. Arista says attackers are already exploiting a new flaw in the on-prem version that turns the lowest read-only login into a superuser.
Arista fixed its hosted orchestrators first. Companies running their own VCO need to upgrade and then check whether someone got in before they did.
The lowest read-only login on an on-prem VeloCloud Orchestrator can become a superuser, and Arista says attackers are doing it now.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Attackers are exploiting a new VeloCloud Orchestrator bug
Arista published Security Advisory 0199 on October 22 for CVE-2026-114625, an SQL injection flaw rated 9.9 under CVSS 3.1. Any authenticated user, down to the built-in Enterprise Read Only role, can gain operator privileges and act as a local “superuser operator,” including functions meant for internal use only.
Arista says it found the flaw itself and that it is being actively exploited. Hosted and Dedicated VCO were affected and are already patched. VeloCloud Edge and Gateway devices are not affected.
On-prem orchestrators that run your SD-WAN branch network
An orchestrator controls routing and security policy for every edge it manages, so a takeover reaches each branch on the SD-WAN. Arista says VCO is exposed by default and no configuration setting prevents the attack. A single valid low-level account is enough.
This is the fourth exploited Arista zero-day this year, according to BleepingComputer. We covered the September one, CVE-2026-93952, on September 23.
Upgrade VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and check the logs
- Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later in your release train. Contact Arista TAC if you are on an unsupported train.
- Until then, allow the VCO web interface only from trusted admin networks.
- Block 74.82.197.86 and 38.54.50.151, the attacker IPs Arista published, and search your logs for them.
- Review the VCO user list and remove or reset read-only and tenant accounts nobody can vouch for.
Forward this
For our network team: Arista says attackers are exploiting a flaw in the on-prem VeloCloud Orchestrator that runs our SD-WAN. Can we confirm whether we run our own orchestrator, upgrade it today, and check its logs for the two IP addresses in Arista’s advisory?
Details
- CVE-2026-114625: SQL injection (CWE-89), CVSS 3.1 9.9, CVSS 4.0 9.4. Minimum role Enterprise Read Only. Tracked as BUG2043622.
- Affected: VCO On-Prem 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12. End-of-support versions were not assessed.
- Not affected: VeloCloud Edge, VeloCloud Gateway, EOS-based switches and CloudVision.
- Exploitation: confirmed by Arista on October 22. Not in CISA KEV as of catalog 2026.10.21.
Hunt / verify
- Look in VCO web access logs for requests with URL-like path segments, encoded characters, references to local or internal services, or high request rates, which Arista lists as signs of the attack.
- Check the VCO host for unexpected outbound connections, new daemons and web shells, and review recent administrator changes.
- If you suspect compromise, preserve web, application, system and database logs and file timestamps before you patch.
Source: Arista Security Advisory 0199; CVE.org: CVE-2026-114625
Sources
- Arista: Security Advisory 0199
- BleepingComputer: Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
- CVE.org: CVE-2026-114625
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
