VeloCloud Orchestrator Zero-Day: Fixed Versions and Steps

Arista has disclosed a critical flaw in VeloCloud Orchestrator, the control center for VeloCloud SD-WAN networks, and says attackers are already exploiting it. Tracked as CVE-2026-114625, the bug lets an account with the lowest privileges take over the orchestrator. Fixed releases for on-premises deployments are 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later.

What happened to VeloCloud Orchestrator

SD-WAN links many offices over ordinary internet connections and manages them from a single place. Each branch runs a device called VeloCloud Edge. Routing, security policies and monitoring for all of those devices are controlled from one web portal, VeloCloud Orchestrator (VCO). The product was previously sold as VMware SD-WAN by VeloCloud and now belongs to Arista Networks, which announced its purchase of the VeloCloud business from Broadcom in July 2025.

According to Arista Security Advisory 0199, published on October 22, 2026, the bug is a SQL injection. This class of flaw occurs when user input is treated as part of a database command. In this case it lets an attacker reach internal functions that ordinary users should never see.

Arista rates the flaw 9.9 under CVSS 3.1 and 9.4 under CVSS 4.0, both critical. An attacker needs two things: network access to the VCO web interface and a valid logged-in session. The minimum role required is Enterprise Read Only, the lowest built-in customer role, which is meant only for viewing data.

From that starting point, any authenticated user can gain operator privileges and pose as a local “superuser operator” account. Arista says exploitation can affect the confidentiality, integrity and availability of the orchestrator and the data it manages. The advisory also states that VCO is exposed by default and that no configuration setting can prevent the exposure.

Affected and fixed versions

The flaw affects VCO installed on customer servers (on-premises). Arista-managed Hosted and Dedicated VCO instances were also affected but have already been patched. VeloCloud Gateway and VeloCloud Edge devices are not affected.

The details from Arista’s advisory:

• 5.2 train: affected before 5.2.3.18, fixed in 5.2.3.18 and later.
• 6.1 train: affected before 6.1.3.10, fixed in 6.1.3.10 and later.
• 6.4 train: affected before 6.4.2.12, fixed in 6.4.2.12 and later.
• Arista did not assess end-of-support releases. Customers on those versions are asked to contact Arista’s Technical Assistance Center (TAC) about upgrade options.

The 7.0 train does not appear on the affected list, and Arista says releases that are not listed are not vulnerable to this issue. One detail deserves attention. As The Hacker News points out, orchestrators that were recently upgraded to close the July and September flaws are still exposed to the new one, because those earlier fixes predate the current fixed releases. For example, the September fix for the 6.4 train landed in 6.4.2.8, while the new fixed release is 6.4.2.12.

Exploitation status

Arista says it found the flaw itself and has confirmed active exploitation. The company shared two IP addresses seen in the attacks: 74.82.197.86 and 38.54.50.151. The advisory does not say when attacks began, who is behind them or how many orchestrators have been compromised.

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on October 23, 2026. US federal civilian agencies were given until October 26, 2026 to apply the fix, a window of three days.

SecurityWeek notes that this is the third VCO flaw exploited as a zero-day in four months. A zero-day is a flaw that attackers use before a fix is available. The two earlier flaws were worse in terms of access:

• CVE-2026-16812 (July 2026), an operating system command injection rated CVSS 10. According to Arista Security Advisory 0144, it required no account at all.
• CVE-2026-93952 (September 2026), an improper input validation flaw rated 10 under CVSS 3.1. Arista Security Advisory 0183 says it also required no credentials, provided certificate-based authentication from Edge to VCO was configured.

The October flaw is the first of the three that requires a login. That condition offers limited comfort, because read-only accounts are often shared widely with vendors, monitoring teams or network service providers. In its July advisory, Arista warned that a compromised orchestrator could give attackers access to Edge devices at branch sites. The October advisory makes no similar statement about the new flaw.

What this means for banks and retail chains

SD-WAN is common in organizations with dozens or hundreds of sites, such as bank branches, retail stores, warehouses and clinic networks. The orchestrator holds the configuration for every one of those sites. An attacker who controls it can change traffic routes and security policies across all branches from a single console. For a bank, that touches transaction paths and customer data. For a retail chain, it touches checkout systems, inventory and cashless payments in every store.

The following steps are based on guidance from Arista and CISA:

1. Identify your orchestrator type and version. Confirm whether your VCO is self-hosted or Hosted. If a service provider runs your network, ask them directly which VCO version they use and when the update will be applied.
2. Upgrade to a fixed release. Install 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later, depending on your train. If you are on an end-of-support release, contact Arista TAC.
3. Restrict portal access until the update is in place. Arista recommends limiting the VCO web interface to trusted administrative networks, blocking the two attacker IP addresses, watching for unusual outbound traffic from the VCO host and closing outbound ports that normal operation does not need.
4. Look for signs of compromise. Review VCO web access logs for URL-like path components, encoded characters, references to local or internal services and high request rates. Watch for unfamiliar background processes and web shells, small files that give attackers a persistent way back in. Review recent administrator changes as well.

If you find signs of intrusion, preserve evidence before remediating. Arista asks customers to keep web access logs, backend application logs, system logs, database logs and relevant file timestamps where feasible. Then review every portal account, including read-only accounts held by third parties, and rotate any credentials that may have been exposed.

Three critical flaws in four months are also a reason to reconsider how network management portals are exposed to the internet. Portals like this should be reachable only from an administrative network or over a VPN, with account lists reviewed regularly. Our cybersecurity services can help build an inventory of internet-facing systems and a patching schedule. Organizations with many stores can look at our retail management solutions for running distributed store systems, while banks and lenders can see our financial services solutions.

Frequently asked questions

Do VeloCloud Edge devices at branches need updating?

Not for this flaw. Arista says VeloCloud Edge and VeloCloud Gateway are not affected by CVE-2026-114625. The component that needs updating is the self-hosted VeloCloud Orchestrator. It is still worth confirming that Edge devices run the versions recommended for other issues.

We use Hosted VCO. Do we need to do anything?

Arista says Hosted and Dedicated VCO instances have already been patched. Even so, review administrator activity and the account list in your portal, since the advisory does not say when attacks began.

Our orchestrator was updated after the September flaw. Is it safe?

Not necessarily. The fixes for the July and September flaws are older than the fixed releases for the October flaw. Make sure you are running at least 5.2.3.18, 6.1.3.10 or 6.4.2.12, depending on your train.

Conclusion

CVE-2026-114625 targets the control center of a network, so a single unpatched orchestrator can open a path to many branches at once. Start by checking your VCO version, installing a fixed release and restricting portal access, then go through the logs for signs of intrusion. If your team needs support reviewing its branch network, Merakit is ready to help.

Sources

• Arista Security Advisory 0199: VeloCloud Orchestrator On-Prem (CVE-2026-114625) (October 22, 2026)
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (October 23, 2026)
• SecurityWeek: Attackers Exploit Third Arista VCO Zero-Day in Four Months (October 23, 2026)
• The Hacker News: Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks (October 22, 2026)
• Arista Security Advisory 0183 (CVE-2026-93952) (September 22, 2026)
• Arista Security Advisory 0144 (CVE-2026-16812) (July 27, 2026)