Arista patches critical VeloCloud Orchestrator flaw exploited in attacks

How the flaw works

A critical vulnerability tracked as CVE-2026-114625 has been found in Arista's VeloCloud Orchestrator (VCO), a web-based tool used to manage VeloCloud SD-WAN networks. The flaw is a SQL injection vulnerability. This means attackers can send specially crafted commands to the database behind the web interface, tricking it into running code it should not. In this case, any user with a valid login, even the lowest-level, read-only customer account, can exploit the flaw to gain operator privileges. Operator is the highest level of access, allowing full control over the orchestrator and the data it manages.

The vulnerability affects on-premises deployments of VCO. Hosted and dedicated orchestrators have already been patched by Arista. The flaw is rated 9.9 out of 10 on the CVSS scale, marking it as critical. According to Arista↗ (opens in a new tab) and CISA↗ (opens in a new tab), attackers need only a basic login and network access to the VCO web interface to exploit the flaw. No user interaction is required beyond logging in.

Who is affected

The vulnerability impacts all on-premises VeloCloud Orchestrator deployments running versions earlier than 5.2.3.18, 6.1.3.10, or 6.4.2.12. Arista Networks is a major networking company with over 10,000 customers worldwide, many of whom use VeloCloud to manage their wide area networks. VeloCloud Gateway and VeloCloud Edge products are not affected. The flaw does not impact the 7.0 release train or any releases not listed by Arista. Customers running unsupported versions are advised to contact Arista for upgrade options.

Is there a fix?

Arista has released patches for the affected versions. Hosted VCO deployments have already been updated. On-premises users must upgrade to version 5.2.3.18, 6.1.3.10, or 6.4.2.12, depending on their release train. Until patched, Arista recommends restricting access to the VCO web interface to trusted networks, blocking known malicious IP addresses (74.82.197.86 and 38.54.50.151), and monitoring logs for suspicious activity. Administrators should also review recent admin activity and check for unusual changes or high request rates. If compromise is suspected, logs and evidence should be preserved before remediation.

The response

CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue↗ (opens in a new tab) on 23 October 2026, confirming that it is being actively exploited. Arista has published advisories and guidance for customers, and urges immediate patching. This is the third exploited zero-day flaw in VCO reported by Arista in four months, following similar incidents in July and September 2026.

What you should do

If you manage an on-premises VeloCloud Orchestrator, update to a fixed version as soon as possible. Restrict web interface access, block the listed malicious IPs, and review logs for signs of attack. If you suspect compromise, preserve all relevant logs and contact Arista's Technical Assistance Center for help.