Arista VeloCloud Orchestrator CVE-2026-114625: Exploited SQL Injection Lets Any Logged-In User Become Operator

Arista disclosed on 22 October 2026 that on-premises VeloCloud Orchestrator (VCO), the management portal for VeloCloud SD-WAN, has a SQL injection flaw, CVE-2026-114625, that it says is being exploited. In Security Advisory 0199, Arista says "any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user", and that the issue "was detected by Arista and is known to be actively exploited". Arista, as the CVE Numbering Authority, scores it 9.9 (CVSS v3.1, critical) and 9.4 (CVSS v4.0). Fixes are out: VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12.

The limits matter as much as the score. An attacker needs a valid VCO login and network access to the VCO web interface. Arista says Hosted and Dedicated VCO "were impacted and have already been patched", so the remaining work sits with organisations that run VCO themselves. VeloCloud Gateway and VeloCloud Edge are not affected. As of 23 October 2026, 08:22 Cyprus time (UTC+3), CISA's Known Exploited Vulnerabilities (KEV) catalog does not list the CVE, and none of the national CERTs we checked (CISA, CERT-EU, NCSC UK, CCB in Belgium, DKCERT, the Canadian Centre for Cyber Security and JPCERT/CC) has published an advisory on it.

Technical Information

What Arista has said (Security Advisory 0199, revision 1.0, 22 October 2026):

• Weakness: CWE-89, SQL injection. Arista tracks it as BUG2043622.
• Impact: the flaw "may allow a remote attacker to access privileged internal functionality and impact the VCO host". Exploitation "may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator". The operator access includes "functionality that is intended for internal use only and which is not intended to be remotely accessible."
• Preconditions: "network access to the VCO web interface and a valid authenticated session on the VCO portal". The minimum role is Enterprise Read Only, which Arista calls "the lowest built-in tenant role".
• Exposure: "VCO is exposed by default." Arista adds: "There is no configuration that can prevent the exposure." In other words, no VCO setting removes the flaw. Only upgrading fixes it, though network restrictions can reduce who can reach the portal.
• Exploitation: Arista says the issue "is known to be actively exploited". The advisory does not say when exploitation started, how many systems were affected, or what attackers did after gaining access. It also does not say whether exploitation took place on Hosted or Dedicated instances before they were patched.
• Scoring: CVSS v3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and CVSS v4.0 9.4, both from Arista. "PR:L" reflects the login requirement.

Why an orchestrator matters. Tenant users sign in to what Arista calls "the VCO portal", and Arista says the flaw lets any of them gain operator privileges, impact the VCO host and affect "data managed by the orchestrator". The advisory does not say whether that extends to VeloCloud Edge devices, so we do not assume it.

Timeline (dates as published; times converted to Cyprus time, UTC+3):

• 21 October 2026, 23:35: The CVE ID is reserved by Arista, according to the CVE record.
• 22 October 2026: Arista publishes Security Advisory 0199, revision 1.0, with fixed releases and two attacker IP addresses.
• 22 October, 23:47: Arista publishes the CVE record on cve.org.
• 23 October, 00:17: NVD receives the record. As of 08:22 Cyprus time on 23 October, its status is "Received", with no NVD score of its own. NVD shows only Arista's scores.
• 23 October, 06:55: The CVE record is updated with an entry from CISA's Vulnrichment program. Its SSVC assessment is dated 22 October 2026 and lists exploitation as "none". Arista's advisory, also dated 22 October, says the issue "is known to be actively exploited". The KEV catalog has not added the CVE.

Affected Product Versions

Per Arista Security Advisory 0199 and the CVE record. Only VeloCloud Orchestrator On-Prem is affected.

Notes:

• Release trains not listed. Arista says that if your release is not on the affected list, "your deployment is not vulnerable". It also notes: "End of support software versions have not been assessed." For VCOs not on a supported release train, Arista says customers "can contact TAC to discuss possible upgrade options".
• Check the exact build. A VCO that was patched recently, for example after an earlier VeloCloud advisory, is not necessarily on a fixed build for this flaw. Compare the exact version with the table above (Rescana guidance).
• Other Arista products. Arista lists its EOS switches, CloudVision, Wi-Fi access points and its other product lines as not affected.

Workaround and Mitigation

1. Upgrade. Move every self-hosted VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12, or a later build in the same train. Arista recommends upgrading "at your earliest convenience". Given the exploitation, treat this as an emergency change (Rescana guidance).

2. Until the upgrade is done, Arista recommends these defence-in-depth controls:

• "Restrict access to the VCO web interface to trusted administrative networks."
• "Monitor the VCO for accesses from known malicious source IPs."
• "Monitor for unexpected outbound network activity from the VCO host."
• "Consider blocking outbound ports not needed for normal activities."
• "Monitor for backdoor daemons and webshells."
• "Review recent administrator activity for unexpected changes."

3. Review who can log in. Because any tenant user can exploit the flaw, the attack surface is every VCO account, not just administrators. Review VCO user accounts, including partner, customer and read-only users. Remove stale or shared accounts, rotate credentials where a login may have been exposed, and enforce MFA or SSO where your deployment supports it (Rescana guidance; Arista's advisory does not mention account hygiene).

4. If you suspect compromise, preserve evidence first. Arista's advisory says: "If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible." Rescana guidance: patching closes the flaw; it does not undo access already gained, a point the advisory does not address.

5. Hosted and Dedicated VCO customers need no upgrade: Arista says these versions "were impacted and have already been patched". The advisory does not say whether any hosted tenant was exploited before it was patched. Asking Arista or your service provider about your own tenant is reasonable (Rescana guidance).

Indicators of Compromise

Arista has published two IP addresses it says were "observed conducting the attacks". It advises blocking them and checking logs for them (defanged here):

• 74.82.197[.]86
• 38.54.50[.]151

Arista also asks operators to review VCO web access logs: "Requests containing unusual URL-like path components, encoded characters, references to local or internal services, or high request rates should be investigated." It has published no file hashes, webshell names or domains. Neither Arista nor any CERT we checked maps the activity to MITRE ATT&CK, and we have not done so either. IP addresses change easily: finding neither address in your logs does not rule out compromise.

(Related reading: our September advisory on an earlier VeloCloud Orchestrator flaw.)

What we will update

We will update this post if Arista revises Security Advisory 0199 (for example with more indicators, a statement on Edge impact, or details on hosted instances), if CISA adds CVE-2026-114625 to the KEV catalog, if NVD publishes its own score, or if a national CERT publishes an advisory or exploitation report.

Sources

• Arista Networks: Security Advisory 0199 (revision 1.0, 22 October 2026)
• CVE Program: CVE-2026-114625 record (CNA: Arista; published 22 October 2026, updated 23 October 2026 with CISA ADP Vulnrichment)
• NIST NVD: CVE-2026-114625 (status "Received", checked 23 October 2026, 08:22 Cyprus time)
• CISA: Known Exploited Vulnerabilities catalog (checked 23 October 2026, 08:22 Cyprus time; catalog version 2026.10.21; CVE not listed)

SD-WAN orchestrators often run at MSPs and suppliers who manage network edges for many customers, so a single self-hosted VCO can sit upstream of your own connectivity. For vendor risk, the useful signal is whether those partners know if they run self-hosted VCO, patch quickly, and check who could log in, not just whether they run VeloCloud.

Forward this to your TPRM owner: Running VeloCloud does not mean a supplier is exposed, since Hosted VCO is already patched and Edges and Gateways are not affected. A short, friendly check this week is still worthwhile (Rescana guidance). Ask your MSPs and key suppliers:

1. Do you run a self-hosted (on-premises) VeloCloud Orchestrator, including one that manages SD-WAN for us?
2. If so, is it on 5.2.3.18, 6.1.3.10, 6.4.2.12 or later, and if not, when will it be, and is the web interface restricted to trusted networks until then?
3. Have you reviewed VCO user accounts, including read-only, partner and customer users, and checked VCO web access and audit logs for the activity and IP addresses Arista published?

Want a fast, evidence-based view of which vendors in your supply chain run exposed network management platforms like this, and how quickly they respond? Book a demo.