The short version: On October 22, 2026, Arista disclosed an actively exploited SQL injection flaw in its VeloCloud Orchestrator (VCO), the central management console for VeloCloud SD-WAN networks. Tracked as CVE-2026-114625 and rated 9.9 out of 10 in severity, it lets any logged-in user, even one with the lowest read-only role, escalate to full operator privileges. If your organization runs VCO on-premises, check your version against the fixed releases below and patch immediately.
What happened
Arista published its advisory on October 22 and confirmed that attackers were already exploiting the flaw before the patch was available, which is what makes this a true zero-day. The vulnerability sits in the VeloCloud Orchestrator, the web-based system that administrators use to configure and manage every customer and partner account across a VeloCloud SD-WAN deployment. Compromising it is about as close to owning the entire network as an attacker can get without touching the edge devices directly.
The flaw is an SQL injection vulnerability. That is an old attack class, which makes its presence in a current enterprise management product noteworthy. According to the advisory, an attacker who can reach the orchestrator’s web interface and log in with any valid account can abuse the injection to elevate privileges all the way to operator level. Arista says the attacker can then act as a local superuser, a role with full access to the orchestrator, and may also be able to affect the host system the orchestrator runs on. From there, the orchestrator and the data it manages can be exposed, modified, or disrupted.
Why read-only access is enough
The detail that has security teams worried is how little access an attacker needs to start. The minimum role that can exploit this flaw is Enterprise Read Only, the lowest built-in role for customer users. In practice, that means a compromised low-level customer account, a forgotten test account, or credentials bought cheaply on the black market could be enough to take over the whole management plane.
There is no configuration that avoids the exposure. Arista notes that VeloCloud Orchestrator is reachable by default and that no VCO setting prevents that exposure. The only requirement is network access to the web interface plus a valid login. That combination is unfortunately common in enterprise environments where partner and customer accounts accumulate over time.
Which versions are affected and fixed
Arista released fixes on October 22 for three release trains. If you run VCO on-premises on any of these, you are affected until you install the fixed build:
| Release train | Affected versions | Fixed in |
|---|---|---|
| 5.2 | Anything before 5.2.3.18 | 5.2.3.18 and later |
| 6.1 | Anything before 6.1.3.10 | 6.1.3.10 and later |
| 6.4 | Anything before 6.4.2.12 | 6.4.2.12 and later |
VeloCloud Gateway and VeloCloud Edge devices are not affected by this flaw. The 7.0 release train is not listed in the advisory, and Arista says any release not on the list is not vulnerable. Hosted and Dedicated orchestrator deployments have already been patched by Arista, so customers on those models do not need to act.
One important catch: if you diligently patched the July and September VeloCloud flaws, you are probably still exposed. Arista warns that the releases containing those earlier fixes are older than the new fixes, so they remain vulnerable to CVE-2026-114625. Patching once did not end the story here.
The third VeloCloud zero-day in three months
This is the third time since late July that Arista has reported an actively exploited flaw in VeloCloud Orchestrator. The July flaw (CVE-2026-16812) and the September flaw (CVE-2026-93952) did not require the attacker to have a login at all. This one is different in the other direction: it is the first of the three that requires authenticated access, but it trades that requirement for a much lower bar, turning any read-only account into a superuser.
SD-WAN infrastructure has been a favorite target for attackers this year. Earlier in October, Cisco patched its own SD-WAN zero-day (CVE-2026-76504), and enterprise network gear keeps showing up in CISA’s exploited-vulnerabilities list, including the Palo Alto PAN-OS zero-day disclosed the same month. Centralized management consoles are high-value targets because one compromise can cascade across every site they manage.
What to do right now
If you run VeloCloud Orchestrator on-premises, treat this as urgent:
- Patch immediately. Upgrade to 5.2.3.18, 6.1.3.10, or 6.4.2.12 (or a later release) in your release train. Hosted and Dedicated customers are already patched and do not need to act.
- Audit your accounts. Because any valid login is enough to exploit this flaw, review VCO accounts for stale, shared, or over-privileged users. Remove or disable anything that should not exist.
- Restrict web interface access. Arista recommends limiting access to the VCO web interface to trusted administrative networks only.
- Check for compromise before you patch. If you suspect exploitation, preserve evidence first: web access logs, backend application logs, system and database logs, along with relevant file-system timestamps. Patching can destroy the traces you need.
- Monitor for the known indicators. Arista published two IP addresses tied to the attacks. Search your logs for them and watch for unusual outbound connections from the VCO host.
If you cannot upgrade immediately, Arista suggests several interim steps: limit web UI access to trusted networks, monitor for connections from known malicious IPs, watch for unexpected outbound network activity, consider blocking unneeded outbound ports, watch for backdoor daemons and webshells on the host, and review recent administrator activity for unexpected changes.
How to check whether you were hit
Arista has not said when the attacks began, which orchestrators were targeted, or what the attackers did after exploiting the flaw. That uncertainty means you should assume the worst until your logs prove otherwise.
Two IP addresses have been observed carrying out the attacks: 74.82.197[.]86 and 38.54.50[.]151. Block them and search your logs for any sign of them. Also review VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, or abnormally high request rates. Those patterns are consistent with SQL injection probing.
One open question: for the July and September flaws, Arista warned that a compromised orchestrator could give attackers a path to VeloCloud Edge devices. The new advisory does not say whether that risk applies here, nor whether upgrading removes access an attacker has already gained. Until that is clarified, a compromised orchestrator should be treated as fully untrusted.
FAQ
What is CVE-2026-114625?
CVE-2026-114625 is an SQL injection vulnerability in Arista’s VeloCloud Orchestrator, disclosed and patched on October 22, 2026. It carries a CVSS severity rating of 9.9 and was already being exploited by attackers before the patch was released. It allows privilege escalation from any logged-in account to full operator privileges.
Do I need to patch if I use Arista’s hosted VeloCloud service?
No. Hosted and Dedicated orchestrator deployments have already been patched by Arista. Only on-premises VCO deployments need to install the fixed releases (5.2.3.18, 6.1.3.10, or 6.4.2.12 depending on your train).
Can attackers exploit this without a login?
No, this particular flaw requires a valid login to the orchestrator’s web interface. However, the minimum role needed is Enterprise Read Only, the lowest customer role, so the barrier is very low. The two earlier VeloCloud zero-days from July and September did not require authentication at all.
Are VeloCloud Edge devices affected?
According to Arista, VeloCloud Gateway and VeloCloud Edge are not affected by this flaw. The advisory does not clarify whether a compromised orchestrator could still be used as a stepping stone to edge devices, as was warned for the earlier flaws.
How does this compare to other recent enterprise zero-days?
The 9.9 CVSS score puts it among the most severe flaws disclosed this month. For comparison, the SonicWall SMA 1000 SSRF flaw from early October scored a 10.0, and the Cisco SD-WAN zero-day also targeted the same product category. The pattern is clear: network management infrastructure is under sustained attack.