Arista has fixed an actively exploited SQL injection flaw in on-premises VeloCloud Orchestrator that turns the most junior customer login into full operator control of an SD-WAN estate. It is the third exploited orchestrator bug since July, and administrators who patched for the earlier two are still exposed.
What happened
On 22 October 2026 Arista published security advisory 0199, covering CVE-2026-114625 in VeloCloud Orchestrator (VCO) On-Prem, the web-based management plane that configures and monitors VeloCloud SD-WAN edges and gateways. The company rates it 9.9 under CVSS 3.1 (9.4 under CVSS 4.0) and states plainly that it is being exploited in the wild.
Fixed builds are available on each supported release train: 5.2.3.18, 6.1.3.10 and 6.4.2.12, or anything later. Arista’s Hosted and Dedicated orchestrators were also vulnerable but have already been patched by the vendor, so the urgent work falls on organisations and service providers running their own instances. The 7.0 train is not listed as affected, and the VeloCloud Edge and Gateway appliances themselves are out of scope.
BleepingComputer and SC Media both count this as the fourth exploited zero-day Arista has patched in 2026. The Hacker News notes it is the third affecting VCO since late July, following CVE-2026-16812 and CVE-2026-93952. Arista has not said when attacks began or who is responsible, but it has published two source IP addresses seen in the activity: 74.82.197.86 and 38.54.50.151.
When I checked the CISA Known Exploited Vulnerabilities catalogue at 06:25 BST on 23 October, the latest version (2026.10.21) did not yet include CVE-2026-114625. Its two VCO predecessors are both listed, each with a three-day remediation deadline for US federal agencies and a forensic triage requirement attached, so a KEV entry for this one would not be a surprise.
The technical picture
Arista classes the bug as SQL injection (CWE-89), although the advisory describes the outcome in terms of privilege escalation and impersonation. Any authenticated user can obtain operator rights and pose as the local “superuser operator” account, which unlocks internal functions that were never meant to be reachable over the network. Arista warns that successful exploitation can hit the confidentiality, integrity and availability of both the orchestrator and the data it manages, and The Hacker News reports that the advisory also raises the possibility of impact on the underlying host.
To understand why that matters, it helps to recall how VCO is structured. Operators sit at the top and create partner and customer accounts; partners can then manage groups of customers beneath them. Exploitation needs nothing more than an Enterprise Read Only account, the weakest role VCO ships with. In a multi-tenant deployment run by a managed service provider, that means a single customer’s least privileged user could, in principle, climb to the level that controls every tenant on the box.
Two further details sharpen the risk. First, the web interface is exposed by default and Arista says there is no configuration option to stop that. Second, the earlier July and September fixes predate the new builds, so an orchestrator brought up to date for those bugs is still vulnerable to this one.
Unlike its two predecessors, this bug needs a valid login. That is a lower bar than it sounds: read-only accounts are handed out generously for reporting and monitoring, and credentials for them are exactly the kind that end up in infostealer logs.
Why it matters for UK organisations
SD-WAN orchestrators are the control point for branch connectivity, so they sit squarely in the category of edge and management infrastructure that attackers have spent the past few years targeting. Whoever controls the orchestrator can change routing, push configuration to edges and see the shape of the whole network. For Arista’s July and September VCO bugs, The Hacker News reports, the vendor warned that a compromised orchestrator could open a path to the VeloCloud Edge devices it manages. The new advisory is silent on whether that applies here, which is not the same as saying it does not.
UK retailers, logistics firms and other multi-site organisations frequently consume SD-WAN as a managed service rather than running it themselves. If that describes you, the orchestrator may belong to your provider, and your exposure depends on how quickly they patch. That supply chain dependency is exactly what the Cyber Security and Resilience Bill aims to bring into scope for managed service providers. The product was previously sold as VMware SD-WAN by VeloCloud and then under Broadcom before Arista announced its purchase in July 2025, so asset registers may still use older names.
Expert view
In my experience, management planes are where privilege models quietly fall apart. When we test multi-tenant platforms, read-only roles get far less scrutiny than administrative ones because everyone assumes they are harmless. This advisory is a good illustration of why that assumption is dangerous: the boundary that matters is not the role label, it is whether every server-side function checks it.
The pattern across 2026 bothers me more than any single CVE. Three exploited orchestrator bugs in roughly three months suggests attackers have studied this code base closely, though Arista has not linked the three. Defenders who treated July and September as one-off fixes should now treat VCO as a platform under sustained attention, with the monitoring and access restrictions that implies, rather than waiting for the next advisory.
Finally, a patch is not a clean bill of health. Arista asks customers to hunt for webshells and backdoor daemons and to preserve logs first, which reads like a vendor expecting some customers to find intruders already inside.
What to do now
- Find every orchestrator. Identify on-premises VCO instances under all three brand names, and ask your managed SD-WAN provider in writing whether it runs on-premises VCO and when it will reach a fixed build.
- Patch to the fixed release on your train. Move to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. If you are on an end-of-support train, contact Arista TAC now. This maps to the Cyber Essentials security update management control.
- Restrict the web interface. Limit access to trusted administrative networks via firewall rules, since VCO itself cannot hide the interface. This is the Cyber Essentials firewalls control in practice.
- Prune accounts. Remove unused Enterprise Read Only and other tenant accounts, rotate credentials and enforce multi-factor authentication where supported, in line with the user access control requirement.
- Preserve evidence, then hunt. Before upgrading, keep web access, application, system and database logs plus file-system timestamps. Search for the two published IP addresses, encoded characters and URL-like path components in requests, references to internal services and bursts of high request rates.
- Look beyond the request logs. Check for unexpected outbound connections from the VCO host, unfamiliar daemons, webshells and recent administrative changes, and close any egress ports the appliance has no business using.
- Review the edges. If you find signs of compromise, treat managed edge configurations as suspect until verified.
Bottom line
CVE-2026-114625 is being used in attacks, needs only the weakest customer login and cannot be switched off by configuration. Patch on-premises VeloCloud Orchestrator today, lock its web interface down to admin networks, and hunt for signs of earlier intrusion before you declare the job done.
Sources
- Arista Networks: Security Advisory 0199 (CVE-2026-114625)
- BleepingComputer: Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
- The Hacker News: Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
- SC Media: Arista Networks patches actively exploited zero-day vulnerability in VeloCloud Orchestrator
- CISA: Known Exploited Vulnerabilities Catalog
