CVE-2026-114625, a SQL injection vulnerability in Arista’s VeloCloud Orchestrator (VCO), carries a 9.9 CVSS score and, according to Arista’s October 22 advisory, is being actively exploited in the wild.
What Arista says is happening
Arista reported that attackers have exploited a zero‑day SQL injection flaw in VeloCloud Orchestrator, the central management system for VeloCloud SD‑WAN networks. The company warned the flaw allows any user who can access the orchestrator’s web interface and supply a valid login—down to the Enterprise Read Only role—to gain operator privileges, the top level of control over the orchestrator.
Arista said the exploit may allow an attacker to act as a local superuser, and that it “may also allow an attacker to affect the VCO host itself and expose, modify, or disrupt the orchestrator and the data it manages.” The advisory does not say when the attacks began, which orchestrators were hit or what attackers did after exploiting the flaw.
Affected releases and fixes
For on‑premises orchestrators Arista lists fixes in these releases: VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted and Dedicated orchestrators have already been patched, the advisory says. Arista also noted that orchestrators running the releases that fixed previously exploited VCO flaws in July and September are still affected when those releases are older than the new fixes.
Arista additionally stated that VeloCloud Gateway and VeloCloud Edge are not affected, that the 7.0 release train is not on the list, and that “any release not on the list is not vulnerable.” The company has not checked releases that have reached end of support; customers on unsupported release trains are advised to contact Arista’s Technical Assistance Center (TAC) about upgrade options.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow the vulnerability is reached and why exposure is easy
The exploit requires two things: network access to the VCO web interface and a valid login. The minimum built‑in role required is Enterprise Read Only, Arista said. VCO is exposed by default, and there is no VCO setting that prevents that exposure, increasing the practical attack surface for organizations that have not restricted access.
Detection, immediate mitigations, and forensic guidance
Arista provided a set of short‑term mitigations for organizations that cannot upgrade immediately: limit access to the VCO web interface to trusted administrative networks; monitor the VCO for connections from known malicious IP addresses; watch for unexpected outbound network activity from the VCO host; consider blocking outbound ports not needed for normal operation; watch for backdoor daemons and webshells; and review recent administrator activity for unexpected changes.
The advisory names two IP addresses seen carrying out the attacks and recommends blocking them and checking logs for signs of their activity: 74.82.197[.]86 and 38.54.50[.]151. Administrators should also inspect VCO web access logs for requests with unusual URL‑like path components, encoded characters, references to local or internal services, or unusually high request rates.
If a compromise is suspected, Arista advises saving evidence before remediation where possible—specifically VCO web access, backend application, system and database logs, and relevant file‑system timestamps.
What this means for technologists, procurement leaders, and affected enterprises
- Technologists and security teams: prioritize locating VCO instances, determine whether they run the listed releases, and apply the appropriate on‑premises fixes (5.2.3.18, 6.1.3.10, 6.4.2.12) or confirm Hosted/Dedicated orchestrator patch status; implement the short‑term network restrictions Arista recommends.
- Procurement and operations leaders: confirm which release trains are in use—unsupported trains were not audited by Arista—and coordinate with Arista TAC on upgrade paths for unsupported deployments.
- Affected enterprises running earlier fixes for July and September flaws: note that releases that addressed those earlier exploits can still be vulnerable if they predate the new fixes; treat this as a separate remediation task rather than assuming prior patches are sufficient.
This is the third VCO flaw Arista has reported as exploited since late July; unlike the July flaw (CVE-2026-16812) and the September flaw (CVE-2026-93952), CVE-2026-114625 is the first of the three that requires a login to exploit. Arista also warned previously that a compromised orchestrator could grant attackers access to VeloCloud Edge devices; for this new flaw the advisory does not say whether that risk applies or whether upgrading removes access an attacker has already gained.
The advisory leaves concrete questions in plain view: which organizations were targeted, what the attackers accomplished post‑intrusion, and whether any compromises extended to Edge devices in the current incidents. For now the immediate, verifiable steps are the listed upgrades and the monitoring and containment measures Arista provided.
