Arista VeloCloud Orchestrator · Exploitation confirmed

Arista patches VeloCloud SQL injection zero-day actively exploited in attacks

Oct 21, 2026 · 1 min read

CVE-2026-114625, a SQL injection flaw in on-premises VeloCloud Orchestrator, lets any authenticated user gain 'superuser operator' privileges. Arista says the flaw is actively exploited and CISA listed it in its KEV catalog; it is the third VCO flaw in the KEV in 2026, after CVE-2026-16812 (July) and CVE-2026-93952 (September). Arista has already patched its hosted and dedicated instances; on-prem customers must upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12.

By HIFY Radar newsroom Updated 10/26/2026 01:11 PM Get this every day →← Back to the feed 8 sources

CriticalVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Arista has fixed a critical flaw in VeloCloud Orchestrator, the product that manages corporate SD-WAN networks. Any user with a valid login, even a read-only account, can take full control of the system. Arista itself states the flaw is already being used in real attacks.

Why it matters

The Orchestrator controls traffic across many branch sites; according to Arista, a compromise may affect the confidentiality, integrity and availability of the orchestrator and the data it manages. The web interface is exposed by default and Arista says no configuration can prevent that exposure. A single stolen low-privilege login is enough for an attacker.

What to do

Upgrade on-prem VCO today to 5.2.3.18, 6.1.3.10 or 6.4.2.12; Arista has already patched its hosted and dedicated instances. Restrict the web interface to trusted admin networks and search logs for the attacker IPs. Contact Arista TAC if you run an unsupported release train.

For the technical team

CVE: CVE-2026-114625
Affected: Arista VeloCloud Orchestrator (VCO) On-Prem · VCO 5.2.x before 5.2.3.18; VCO 6.1.x before 6.1.3.10; VCO 6.4.x before 6.4.2.12. VeloCloud Gateway, VeloCloud Edge and Arista EOS products are not affected.
Exploitation: Active exploitation; Arista states the flaw 'was detected by Arista and is known to be actively exploited'. CISA listed CVE-2026-114625 in its KEV catalog. Third VCO flaw in the KEV in 2026, after CVE-2026-16812 (OS command injection, July) and CVE-2026-93952 (input validation, September), per SecurityOnline.
Fix: Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12. Arista has already patched its hosted and dedicated VCO instances; on-prem customers must update themselves. For unsupported release trains, contact Arista TAC. Mitigation: restrict the VCO web interface to trusted admin networks.
Vector: SQL injection (CWE-89) in on-premises VeloCloud Orchestrator. Any authenticated user, even the lowest built-in tenant role (Enterprise Read Only), can gain operator privileges and masquerade as a local 'superuser operator' user, unlocking functions intended for internal use only. The VCO web interface is exposed by default and, per Arista, there is no configuration that can prevent the exposure.
More details: CVSS 9.9 (SecurityOnline). Covered by Arista Security Advisory 0199, dated 2026-10-22. Arista recommends blocking and searching logs for the attacker IPs, watching for unexpected outbound traffic, backdoor daemons and webshells, reviewing recent admin activity, and checking web access logs for odd URL paths, encoded characters or high request rates. Preserve logs and file timestamps before patching. NCSC-NL published advisory NCSC-2026-0385 on 2026-09-22 covering the earlier flaw CVE-2026-93952 (path traversal, CVSS v4 9.5).