If you run an on-premises VeloCloud Orchestrator, this is the third time since July you've had to patch an actively exploited zero-day. On October 22, Arista published Security Advisory 0199 for CVE-2026-114625. The flaw is a SQL injection with a CVSSv3.1 score of 9.9, and it lets any logged-in user, including one with the lowest built-in tenant role, gain operator-level control of the orchestrator. Arista's own wording: "This issue was detected by Arista and is known to be actively exploited."

The orchestrator (VCO) is the management plane for a VeloCloud SD-WAN deployment. It is the central portal administrators use to configure, monitor and manage the SD-WAN and its edge devices at branch offices and data centers. That makes it a valuable target. Someone who controls the orchestrator controls how the network is managed.

What the bug does

SQL injection (CWE-89) happens when an application builds a database query from user input without properly separating data from commands, so crafted input can change what the query does. Arista says any authenticated user can exploit it in VCO to gain operator privileges and "masquerade" as the local "superuser operator" user, including access to functionality meant for internal use only. Arista adds that it may allow a remote attacker to impact the VCO host itself.

The CVSS vector explains the 9.9 score: network-reachable, low attack complexity, low privileges required, no user interaction, and a scope change. Scope change means the damage reaches beyond the component that has the bug. Confidentiality, integrity and availability are all rated high. Under CVSSv4.0 Arista scores it 9.4. Arista tracks it internally as BUG2043622.

The key detail is the "low privileges" requirement. The Hacker News reports that the minimum role needed is Enterprise Read Only, the lowest built-in role for customer users, along with network access to the orchestrator's web interface and a valid login. BleepingComputer describes the requirements as basic privileges plus a valid authenticated session. So any read-only login, however it was obtained, is enough to reach operator-level control. That includes accounts issued to customers or partners and credentials that have leaked or been stolen.

SecurityWeek reports Arista as saying VCO deployments are exposed by default, and "There is no configuration that can prevent the exposure." No setting turns this off. Your options are to upgrade, or to limit who can reach the interface while you prepare to upgrade.

Three in four months

As SecurityWeek notes, this is the third exploited VCO zero-day in four months. CVE-2026-16812 came in July and CVE-2026-93952 in September. According to The Hacker News, the new flaw is also the first of the three that requires a login; neither the July nor the September flaw needed one. BleepingComputer lists another exploited Arista zero-day earlier in the year, CVE-2026-7473 in May, affecting EOS rather than VCO.

The cadence matters for one specific reason. According to The Hacker News, orchestrators running the releases that fixed the July and September flaws are still affected by this one, because those releases are older than the new fixes. If you patched promptly in September, you still need to patch again now.

The September patch has its own gap. The Hacker News reports that CVE-2026-93952 was fixed only in the 5.2 train (5.2.3.16) and the 6.4 train (6.4.2.8), with no fixed 6.1 release listed. The October advisory does list a 6.1 fix (6.1.3.10), but according to The Hacker News neither advisory says whether that release also fixes the September flaw. If you run 6.1, confirm your status with Arista's Technical Assistance Center.

Some background on the product: Arista bought the VeloCloud SD-WAN line from Broadcom, with the deal announced in July 2025, according to The Hacker News. The products were earlier known as VMware SD-WAN by VeloCloud.

What we don't know

The Hacker News points out that the advisory does not say when exploitation began, which orchestrators were hit, or what attackers did once inside. Arista hasn't attributed the activity to any group, and neither have the sources cited here. ZeroDayFeed is not attributing it either.

The NVD entry, CVE-2026-114625, was published October 22 with Arista's PSIRT as the source. Its status is "Received," meaning NIST hasn't done its own analysis yet. The description matches the vendor advisory.

Arista's mitigation advice hints at what it is worried about. It tells defenders to watch for backdoor daemons and webshells, to consider blocking outbound ports the orchestrator doesn't need, and to search web logs for unusual URL-like path components, encoded characters, references to local or internal services and high request rates. That reads as advice for a case where attackers leave persistent access behind, though the advisory does not say so. For the July and September flaws, The Hacker News reports Arista warned that a compromised orchestrator could also grant attackers access to VeloCloud Edge devices; for this flaw the advisory does not say whether that risk applies.

What It Means for Defenders

Who is affected. Customers running VeloCloud Orchestrator on their own infrastructure. Arista says Hosted and Dedicated VCO instances, the ones it runs for customers, have already been patched. Per The Hacker News, VeloCloud Gateways and Edges are not affected, and the 7.0 train is not listed in the advisory. Arista did not assess end-of-support versions, so if you're on one, treat yourself as potentially vulnerable and contact Arista's Technical Assistance Center about upgrade options.

Affected and fixed versions, per Arista Security Advisory 0199:

  • VCO 5.2.x before 5.2.3.18: upgrade to 5.2.3.18 or later
  • VCO 6.1.x before 6.1.3.10: upgrade to 6.1.3.10 or later
  • VCO 6.4.x before 6.4.2.12: upgrade to 6.4.2.12 or later

Before you patch, preserve evidence. If compromise is suspected, Arista advises preserving VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediation, where operationally feasible. Upgrading may overwrite or rotate records you would need to work out whether you were compromised, so copy them somewhere else first.

Interim mitigations (these reduce exposure but do not fix the flaw), per Arista's advisory:

  • Block the IP addresses Arista says were observed conducting the attacks: 74[.]82.197.86 and 38[.]54.50.151 (defanged here), and check logs for any sign of them.
  • Limit access to the VCO web interface to trusted administrative networks. It should not be reachable from the open internet.
  • Monitor for unexpected outbound network activity from the VCO host, and consider blocking outbound ports not needed for normal operation.

Hunt for compromise. Review recent administrator activity for changes you can't explain, particularly any that trace back to low-privilege accounts. Search web logs for requests with unusual URL-like path components, encoded characters, references to internal services or high request rates. Check the host for unfamiliar daemons and webshells. Because this flaw follows two other exploited VCO bugs, extending your log review back to July, if retention allows, is a reasonable precaution.

Rotate and review accounts. Every authenticated account is a potential attack path, so audit the user list. Remove stale and shared logins, and reset credentials for accounts held by third parties such as partners, customers or contractors. If you find signs of compromise, assume an attacker may have had superuser-level access to the orchestrator and review the configuration it manages. Consider rotating secrets the orchestrator stores, and treat the incident as a network-wide event, not just a single host.

For CMMC and federal contractors: an SD-WAN orchestrator that manages links into environments handling CUI is plausibly in scope for your configuration management and incident response practices. Record when you patched, keep the logs you preserved, and if your hunt turns anything up, follow your incident reporting obligations.

Arista says it detected this flaw itself, which is better than learning about it from a ransom note. Still, the July, September and October bugs all affected the same management plane. An orchestrator web interface reachable by any authenticated user has turned out to be a recurring liability, and moving it behind an admin-only network boundary is a sensible change even after you patch.

Sources