Arista Networks has released emergency patches for a critical vulnerability in VeloCloud Orchestrator that attackers are already exploiting. The flaw, tracked as CVE-2026-114625, lets a user with only the lowest level of access to the platform escalate to full administrative control.
VeloCloud Orchestrator, known as VCO, is the web console that network administrators use to manage VeloCloud SD-WAN deployments and the edge devices connected to them. Arista acquired the VeloCloud product line from Broadcom in 2025. The software was previously sold as VMware SD-WAN by VeloCloud.
According to Arista’s security advisory, the vulnerability is a SQL injection flaw that does not require much skill to exploit. An attacker only needs network access to the VCO web interface and a valid login, even one limited to the lowest built-in role, Enterprise Read Only. From that starting point, the attacker can impersonate a local superuser operator account and gain what Arista describes as the top level of control over the system. The Hacker News reported that the flaw carries a CVSS score of 9.9 out of 10.
Arista says the flaw is being actively exploited, though its advisory does not say how many organizations have been affected or what attackers have done after breaking in. The company has told customers to watch for and block two IP addresses tied to the ongoing attacks: 74.82.197.86 and 38.54.50.151.
This is the third VeloCloud Orchestrator zero-day Arista has had to patch in roughly four months, following CVE-2026-16812 in July and CVE-2026-93952 in September. Both earlier flaws also affected on-premises VCO deployments and were already being exploited before fixes became available.
Arista has fixed the new flaw in VCO versions 5.2.3.18, 6.1.3.10, and 6.4.2.12, along with later releases on each branch. Hosted and Dedicated VCO deployments, which Arista manages directly on customers’ behalf, were already patched before the advisory went public. VeloCloud Edge devices and VeloCloud Gateway are not affected. Organizations running their own on-premises orchestrators need to apply the update themselves as soon as possible.
Until they can patch, Arista recommends restricting access to the VCO web interface to trusted administrative networks, watching for unusual outbound traffic from the orchestrator host, and reviewing web access logs for strange URL paths or unexpectedly high request volumes. If a compromise is suspected, the company advises preserving web, application, system, and database logs, along with file timestamps, before starting remediation, and contacting its Technical Assistance Center directly.
Arista’s advisory does not say who discovered or reported the vulnerability.
Source: BleepingComputer and The Hacker News.
