Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.
The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.
For on-premises orchestrators, the fix is in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, while Hosted and Dedicated orchestrators have already been patched.
The flaw is tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale. Orchestrators running the releases that fixed the VCO flaws exploited in July and September are still affected, because those releases are older than the new fixes.
Arista bought the VeloCloud SD-WAN product line from Broadcom, announcing the deal in July 2025. The products were earlier known as VMware SD-WAN by VeloCloud.
To exploit the flaw, an attacker needs network access to the orchestrator’s web interface and a valid login. The minimum role is Enterprise Read Only, the lowest built-in role for customer users. VCO is exposed by default, and no VCO setting prevents the exposure.
In VCO, operators create the customer and partner accounts, and each partner can manage a group of customers. The flaw allows an attacker to act as a local superuser, a role with full access. It may also allow an attacker to affect the VCO host itself and expose, modify, or disrupt the orchestrator and the data it manages.
The advisory does not say when the attacks began, which orchestrators were hit, or what the attackers did after exploiting the flaw.
The new flaw is the third in VCO since late July that Arista has reported as exploited, and the first of the three that requires a login. Neither the July flaw (CVE-2026-16812) nor the September flaw (CVE-2026-93952) needed one.
Affected and Fixed Releases
Each affected release train has its own fix, shown here beside the release that fixed September’s flaw on the same train.
| Release train | Affected by CVE-2026-114625 | Fixed in | CVE-2026-93952 (September) fixed in |
|---|---|---|---|
| 5.2 | Before 5.2.3.18 | 5.2.3.18 and later | 5.2.3.16 |
| 6.1 | Before 6.1.3.10 | 6.1.3.10 and later | No fix listed |
| 6.4 | Before 6.4.2.12 | 6.4.2.12 and later | 6.4.2.8 |
VeloCloud Gateway and VeloCloud Edge are not affected. The 7.0 release train is not on the list, and Arista says any release not on the list is not vulnerable.
Arista has not checked releases that have reached end of support. Customers on an unsupported release train can contact Arista’s Technical Assistance Center (TAC) about upgrade options.
As of October 22, September’s flaw is fixed only in the 5.2 and 6.4 trains. On 6.1, it affects releases up to 6.1.3.7, and no fixed release is listed. Neither advisory says whether 6.1.3.10 also fixes the September flaw.
If You Cannot Upgrade Yet
Until the fixed release is installed, Arista recommends these steps:
- Limit access to the VCO web interface to trusted administrative networks.
- Monitor the VCO for connections from known malicious IP addresses.
- Watch for unexpected outbound network activity from the VCO host.
- Consider blocking outbound ports that normal operation does not need.
- Watch for backdoor daemons and webshells.
- Review recent administrator activity for unexpected changes.
Checking for Compromise
Two IP addresses have been seen carrying out the attacks, according to Arista. Block them and check logs for any sign of them:
- IP: 74.82.197[.]86
- IP: 38.54.50[.]151
Also check VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates.
If you suspect a compromise, save evidence before fixing anything, where possible. That means the VCO web access, backend application, system and database logs, along with the relevant file-system timestamps.
Regarding the July and September flaws, Arista warned that a compromised orchestrator could also grant attackers access to VeloCloud Edge devices. For this flaw, the advisory does not say whether the risk applies or whether upgrading removes access that an attacker has already gained.
