Pulp-style warning robot with a red beacon pointing at a cracked padlock

Arista VeloCloud Orchestrator CVE-2026-114625: exploited, patch on-prem VCO now

ALERT · Actively exploited. Last updated 26 October 2026. See the Alert Tracker

An authenticated SQL injection lets any tenant user, down to Enterprise Read Only, gain operator privileges as a ‘superuser operator’. Arista found the attacks itself and has shipped fixes for on-prem VeloCloud Orchestrator. CISA gave US federal agencies until today, 26 October, to act.

What it is

Arista’s Security Advisory 0199 (opens in a new tab), published on 22 October, covers CVE-2026-114625 in VeloCloud Orchestrator (VCO), the management plane for VeloCloud SD-WAN. On an affected on-prem VCO, “any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user”, which includes functionality meant for internal use only.

Arista is plain about the risk: “This issue was detected by Arista and is known to be actively exploited.” CISA added it to the Known Exploited Vulnerabilities catalogue (opens in a new tab) on 23 October, with a federal due date of 26 October, and flags it for forensic triage.

Hosted VCO is already dealt with. Arista says “Hosted, including Dedicated, versions of VCO were impacted and have already been patched.” If you run your own orchestrator, the job is yours.

Scores

  • CVSS 3.1: 9.9 (Critical), from Arista as the CVE Numbering Authority (CNA).
  • CVSS 4.0: 9.4 (Critical), also from Arista, and shown unchanged on NVD (opens in a new tab).

Who is affected

  • Affected: VeloCloud Orchestrator on-prem, 5.2 releases before 5.2.3.18, 6.1 releases before 6.1.3.10 and 6.4 releases before 6.4.2.12.
  • Not assessed: end-of-support releases. Arista has not assessed them, so contact Arista’s Technical Assistance Center (TAC) to discuss upgrade options.
  • Exposure: an attacker needs network access to the VCO web interface and any valid login. Arista says “VCO is exposed by default” and “There is no configuration that can prevent the exposure.”
  • Not affected: VeloCloud Edge, VeloCloud Gateway and Arista EOS products. This is a separate issue from the unfixed EOS flaw CVE-2026-7473.

What to do

  • Preserve evidence first. Before you remediate, keep the VCO web access, backend application, system and database logs, plus file-system timestamps. Patching can wipe the trail.
  • Upgrade. Move to 5.2.3.18, 6.1.3.10 or 6.4.2.12, or later in the same train.
  • Until patched, fence it. Restrict the VCO web interface to trusted administrative networks, and block outbound ports it does not need.
  • Block and hunt for the attacker IPs below, at the perimeter and in VCO web access logs.
  • Look for signs of compromise. Watch for unexpected outbound traffic from the VCO host, backdoor daemons and webshells, and review recent administrator activity for changes nobody made. Arista also suggests investigating requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates.
  • Check the accounts. Every tenant login, including read-only ones, was enough to exploit this. Review who has VCO accounts and remove the ones nobody needs.

Indicators

Arista lists two IP addresses seen conducting the attacks:

  • 74.82.197[.]86
  • 38.54.50[.]151

Indicators are provided as-is for defensive use and age quickly. Check the date and source before acting on them. Terms.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)