VeloCloud Orchestrator Zero-Day CVE-2026-114625 Exploited

Arista disclosed an actively exploited VeloCloud Orchestrator zero-day on October 22, 2026. CVE-2026-114625 is a SQL injection flaw (CVSS 3.1 9.9) in on-prem VeloCloud Orchestrator (VCO). It lets any logged-in user, down to the Enterprise Read Only role, take over a local "superuser operator" identity and reach functions meant for internal use only. Arista's hosted and Dedicated VCO instances are already patched. On-prem operators should upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12, restrict the web interface and check their logs for the two attacker IP addresses Arista published.

What happened

Arista published Security Advisory 0199 on October 22, 2026, tracked internally as BUG2043622. The advisory says Arista found the issue itself and that it is known to be actively exploited. The CVE record, published by Arista as the CNA the same day, classifies the bug as CWE-89 (SQL injection) and scores it 9.9 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and 9.4 under CVSS 4.0.

The impact statement matches the wording of Arista's two earlier VCO advisories this year: a remote attacker "may access privileged internal functionality and impact the VCO host," which puts the confidentiality, integrity and availability of the orchestrator and the data it manages at risk. The difference this time is the starting point. The attacker needs a valid session on the VCO portal first, but any tenant account will do.

This is the third exploited VCO flaw since July. BleepingComputer counts it as Arista's fourth exploited zero-day of 2026 once an EOS switch bug from earlier in the year is included.

Who is affected

The advisory covers VeloCloud Orchestrator On-Prem, the product formerly sold as VeloCloud Orchestrator by Broadcom. Affected and fixed releases:

5.2.x before 5.2.3.18: fixed in 5.2.3.18 and later
6.1.x before 6.1.3.10: fixed in 6.1.3.10 and later
6.4.x before 6.4.2.12: fixed in 6.4.2.12 and later

Arista has not assessed end-of-support trains. Customers on those releases are told to contact Arista TAC about an upgrade path. Arista lists EOS platforms, CloudVision, DMF and the VeloCloud Gateway and Edge as not affected.

Hosted VCO, including Dedicated instances, was also vulnerable and Arista has already patched it. If you consume VCO as a hosted service, the urgent work is reviewing your own tenant activity, not patching.

How the VeloCloud Orchestrator zero-day works

The orchestrator is the management plane for a VeloCloud SD-WAN. It holds the configuration for every Edge it manages, along with the accounts and keys used to run them. Our explainer on what an SD-WAN orchestrator is and what it can reach covers why that makes it a high-value target.

CVE-2026-114625 is a vertical privilege escalation. According to the advisory, the minimum role needed is Enterprise Read Only, the lowest built-in tenant role. From there a crafted request lets the user act as a local superuser operator, the role that runs the orchestrator itself rather than a single customer's network. CVSS marks the scope as changed for that reason: the bug starts inside one tenant and ends with control over the platform. Arista also states that the VCO web interface is exposed by default and that no configuration option removes the exposure.

The requirement for a session is a smaller barrier than it looks. Read-only accounts are handed out to auditors, NOC staff, managed service providers and monitoring integrations, and they are rarely reviewed. Any of those credentials, phished or reused, is now enough. Arista has not said how the attackers it observed obtained their sessions.

The two earlier VCO flaws needed no credentials at all:

CVE-2026-16812 (published July 27, 2026, CVSS 10.0, OS command injection): fixed in 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1. Exploited before disclosure.
CVE-2026-93952 (Advisory 0183, September 22, 2026, CVSS 3.1 10.0, improper input validation): exploitable when certificate-based authentication from Edge to VCO is configured and the attacker holds the public half of an Edge certificate. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a September 25 deadline.

Aviatrix's analysis reads the sequence as one sustained campaign that moved from unauthenticated bugs to an authenticated escalation once those were closed. Arista has not attributed any of the three, so treat that as an assessment, not a finding. CVE-2026-114625 was not in the KEV catalog as of the October 21 release, which predates the disclosure.

What to do now

Upgrade. Move every on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. A VCO patched for the July or September bugs is not covered: every build below these versions is affected.
Preserve evidence first if you suspect compromise. Arista asks for VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps to be kept before remediation where possible. Our guide on how to preserve evidence before patching covers the order of operations.
Restrict the web interface. Limit access to trusted administrative networks. Read-only users from outside those networks are now an attack path.
Block and hunt for the published IP addresses. Arista observed attacks from 74.82.197[.]86 and 38.54.50[.]151. Block them and search historical logs for both.
Review VCO web access logs for unusual URL-like path components, encoded characters, references to local or internal services and high request rates.
Watch the host. Look for unexpected outbound connections from the VCO server, new daemons and web shells. Arista also suggests blocking outbound ports the orchestrator does not need.
Review accounts and admin activity. List every tenant user, remove the ones nobody can vouch for and check recent operator-level changes. Our walkthrough on how to audit read-only accounts on a management portal gives a repeatable process.

If you never fully cleared the September incident, check for the CVE-2026-93952 indicators too. Advisory 0183 listed /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond, /etc/systemd/system/vc-sysmon.service, an nginx log header x-vc-opt and source addresses 142.93.149[.]77 and 104.248.126[.]159. For confirmed compromise, that advisory also recommends rotating credentials, validating the state of managed devices and rebuilding the instance from trusted sources, because a compromised VCO can expose the Edges it manages.

What to watch next

CISA KEV listing. The two previous exploited VCO bugs were added quickly. A listing would set a federal deadline and usually brings wider scanning.
Arista advisory revisions. Revision 1.0 has no file-based indicators and does not mention the 7.0 train, which Advisory 0183 listed as affected by the September bug. Check for updates before closing the ticket.
Attribution or victim counts. Three exploited orchestrator bugs in four months suggest a patient operator. If this is the third time your VCO has needed an emergency patch, read our piece on why repeat zero-days in one product need a different plan.