23 OCT 2026 — Arista Networks has patched a SQL injection flaw in the on-premises edition of VeloCloud Orchestrator that attackers were already using. The company's 22 October advisory, tracking the bug as CVE-2026-114625, says any authenticated user on an unpatched orchestrator can take on operator privileges. The lowest read-only login on the system is enough.
This is the third VeloCloud Orchestrator flaw since July that Arista has reported as exploited in the wild. The two earlier ones needed no login at all.
What Arista disclosed on 22 October
VeloCloud Orchestrator, or VCO, is the management portal for the VeloCloud SD-WAN product line, which Arista took over from Broadcom. In Security Advisory 0199, Arista classes the bug as SQL injection (CWE-89) and scores it 9.9 out of 10 under CVSS 3.1 and 9.4 under CVSS 4.0. The advisory states that the issue "was detected by Arista and is known to be actively exploited". The earlier two VCO bugs this year were both found by outside parties.
On an affected orchestrator, Arista writes, "any authenticated user can gain operator privileges" and pose as a local superuser operator. That role reaches functions meant for internal use only. A successful attack, the company warns, may also affect the VCO host and the data the orchestrator manages.
A low-level login is enough
An attacker must be able to reach the orchestrator's web interface over the network and must hold a working portal session. Arista names Enterprise Read Only, the most limited built-in tenant role, as the minimum. Its advisory adds that VCO is exposed by default: "There is no configuration that can prevent the exposure."
The vector string bears this out. Arista rates the attack as network-based and low in complexity, with no user interaction and a changed scope. The need for a login is the only thing keeping it a tenth below the 10.0 given to the September bug. Readers who want to see how each metric moves the figure can enter the published vector into our CVSS 3.1 calculator.
Hosted VCO, including Dedicated instances, was also affected. Arista says those have already been patched, so the work falls on organisations that run the orchestrator themselves.
Which releases are affected
Three on-premises release trains are listed. On 5.2, everything before 5.2.3.18 is vulnerable. On 6.1 the cut-off is 6.1.3.10, and on 6.4 it is 6.4.2.12. Arista says a release missing from its list is not vulnerable, and the 7.0 train does not appear. It also says it has not assessed versions that have reached end of support, and invites customers on those to contact its Technical Assistance Center about upgrade paths.
Earlier patches do not cover this one. The releases that fixed the July and September flaws all predate the new fixes, a point The Hacker News made in its write-up. A second gap remains open on 6.1. The September advisory, as we read it on 23 October, still lists no fixed 6.1 release for that earlier bug, and nothing in either document says whether 6.1.3.10 closes it too.
Third exploited orchestrator flaw since July
CVE-2026-16812, an OS command injection disclosed in Advisory 0144 on 27 July, needed no tenant or operator credentials. Nor did CVE-2026-93952, an input-validation flaw in Advisory 0183 on 22 September. Both sit in CISA's Known Exploited Vulnerabilities catalogue, added on the same day Arista published.
Each fix has asked for a fresh upgrade. An organisation that patched promptly in July, then again in September, is exposed once more. BleepingComputer counts this as the fourth actively exploited zero-day Arista has patched this year, adding a flaw in its Extensible Operating System to the three VCO bugs.
What defenders are told to do
Upgrading is the fix. Until that is possible, Arista recommends limiting the web interface to trusted administrative networks, watching for unexpected outbound traffic from the VCO host and for backdoor daemons or webshells, and checking recent administrator activity for changes nobody made.
The advisory names two source addresses seen carrying out the attacks, 38.54.50[.]151 and 74.82.197[.]86, and asks operators to block them and search their logs. It also flags web requests with odd URL-like path components, encoded characters, references to internal services, or high request rates. Where compromise is suspected, Arista wants web, application, system and database logs preserved, along with file-system timestamps, before anything is remediated.
What the advisory leaves out
Arista does not say when the attacks began, how many orchestrators were hit, who was behind them or what the attackers did once inside. No victims are named, and we have not found any official record that does.
The two earlier advisories warned that a compromised orchestrator may hand attackers access to the VeloCloud Edge devices it manages, and set out post-remediation steps such as rotating credentials. Advisory 0199 carries no such section, so it is not clear whether that risk applies here or whether upgrading removes access already gained.
Official tracking has also lagged the vendor. The NVD record, published late on 22 October UTC, still showed the status "Received" when we checked on 23 October. A CISA assessment attached to it, dated 22 October, logs exploitation as "none". The KEV catalogue, last updated on 21 October, did not yet list the CVE. For on-premises operators, Arista's own statement that the bug is being exploited is the signal to act on.
View author profile → · Editorial policy
