VeloCloud Orchestrator Zero-Day Under Active Attack: Arista Releases Patches for CVE-2026-114625

On October 22, Arista confirmed that attackers are actively exploiting CVE-2026-114625 in VeloCloud Orchestrator. Patches are available for customer-managed deployments. Arista says it has already updated the environments it hosts, including dedicated instances.

What the vulnerability allows

The flaw is a SQL injection vulnerability in the platform that manages SD-WAN infrastructure. To exploit it, an attacker needs access to the web interface and a valid user session. The lowest built-in customer role, Enterprise Read Only, is enough.

Exploiting the flaw gives an attacker operator privileges and lets them impersonate the local “superuser operator” account. That also opens up features meant only for internal use. Arista warns that the flaw threatens the confidentiality, integrity and availability of the system and the data it manages.

Which versions are patched

Administrators should check their VCO version against the vendor’s advisory. The fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12 in their respective branches. Arista has not assessed end-of-support versions. Organizations running them should work with Arista technical support to plan an upgrade.

What to do now

• Update affected deployments and restrict access to the management console to trusted administrative networks.
• Check logs for the IP addresses 74.82.197.86 and 38.54.50.151, which Arista identified as attack sources.
• Look into unusual requests, outbound connections and recent administrator activity.
• If you suspect a compromise, preserve all available logs and other evidence before you begin remediation.

SecurHUB’s take

When attackers are actively targeting a network management system, patching alone is not enough. You also need to review what happened on the system before the update. Our incident response team can help you determine the scope of a breach and plan remediation.

Sources: Arista, BleepingComputer