Arista Networks says a critical flaw in its VeloCloud Orchestrator (VCO), the management console for SD-WAN deployments, is being actively exploited. Anyone holding even the lowest tenant login can use it to take over operator-level functions, which makes stolen or reused credentials especially dangerous. Organizations running VCO on their own servers need to patch themselves.
What happened
On October 22, 2026, Arista published Security Advisory 0199 for CVE-2026-114625, a SQL injection weakness rated 9.9 (critical) under CVSS 3.1 and 9.4 under CVSS 4.0. According to the advisory, a remote attacker with a valid authenticated session can gain operator privileges and impersonate the local “superuser operator” account, reaching functions meant for internal use only. That can affect the VCO host and the data it manages.
The minimum role needed is Enterprise Read Only, the lowest built-in tenant role. Arista states that VCO is exposed by default and that no configuration option prevents this. The company says it detected the issue and that it is known to be actively exploited. It lists two source IP addresses seen in the attacks: 74.82.197.86 and 38.54.50.151.
Who is affected
| VCO release train | Fixed in |
|---|---|
| 5.2.x | 5.2.3.18 |
| 6.1.x | 6.1.3.10 |
| 6.4.x | 6.4.2.12 |
Versions before those fixed releases are affected, and Arista says end-of-support versions were not assessed. Hosted and dedicated VCO instances were also affected but, per the advisory, have already been patched by Arista. The affected product is VeloCloud Orchestrator On-Prem, so customers who run their own orchestrator carry the remaining risk. Security news site Daily CyberSecurity reports that VeloCloud Gateway, VeloCloud Edge and Arista EOS are not affected. BleepingComputer reports this is not the first exploited Arista flaw this year, though outlets differ on how many there have been, so we do not give a count.
What to do
The steps below come from Arista’s advisory unless marked as our analysis.
- Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10, 6.4.2.12 or a later release in the same train. If you run an unsupported train, contact Arista TAC.
- Until you can patch, limit access to the VCO web interface to trusted administrative networks, and block the two IP addresses above.
- Search web access logs for those IPs, unusual URL-like path components, encoded characters, references to internal services and high request rates.
- Watch for unexpected outbound traffic from the VCO host, backdoor daemons and webshells, and review recent administrator activity for changes you did not make.
- If you suspect compromise, preserve web, application, system and database logs and file timestamps before remediating.
- Our analysis: because a read-only account is enough, also review which tenant accounts exist and rotate credentials for any you cannot account for.
What we still do not know
Arista has not said how many organizations were compromised, when exploitation began, who is behind it, or which internal functions are exposed. We could not confirm whether CISA has added this CVE to its Known Exploited Vulnerabilities catalog. Some secondary write-ups describe post-exploitation activity such as webshells and lateral movement toward edge devices, but the advisory does not confirm those details, so treat them as unverified.
Sources: Arista Security Advisory 0199 (Oct. 22, 2026); BleepingComputer (Oct. 22, 2026); Daily CyberSecurity (Oct. 22, 2026); Aviatrix Threat Research (Oct. 22, 2026).
Leave a Reply