Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. Tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale, the bug lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.
To exploit it, an attacker needs network access to the orchestrator's web interface and a valid login; the minimum role is Enterprise Read Only, the lowest built-in role for customer users. VCO is exposed by default, and no VCO setting prevents the exposure. The flaw allows an attacker to act as a local superuser, a role with full access, and may also allow an attacker to affect the VCO host itself and expose, modify, or disrupt the orchestrator and the data it manages.
For on-premises orchestrators, the fix is in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, while Hosted and Dedicated orchestrators have already been patched. Orchestrators running the releases that fixed the VCO flaws exploited in July and September are still affected, because those releases are older than the new fixes. VeloCloud Gateway and VeloCloud Edge are not affected, and Arista says any release not on the list is not vulnerable. Releases that have reached end of support have not been checked; customers on an unsupported train can contact Arista's Technical Assistance Center about upgrade options.
The advisory does not say when the attacks began, which orchestrators were hit, or what the attackers did after exploiting the flaw. It is the third VCO flaw since late July that Arista has reported as exploited, and the first of the three that requires a login; neither the July flaw (CVE-2026-16812) nor the September flaw (CVE-2026-93952) needed one. As of October 22, September's flaw is fixed only in the 5.2 and 6.4 trains; on 6.1 it affects releases up to 6.1.3.7, with no fixed release listed, and neither advisory says whether 6.1.3.10 also fixes it.
Until the fixed release is installed, Arista recommends limiting access to the VCO web interface to trusted administrative networks, monitoring the VCO for connections from known malicious IP addresses, watching for unexpected outbound network activity from the VCO host, considering blocking outbound ports that normal operation does not need, watching for backdoor daemons and webshells, and reviewing recent administrator activity for unexpected changes.
Two IP addresses have been seen carrying out the attacks, according to Arista: 74.82.197[.]86 and 38.54.50[.]151. Block them and check logs for any sign of them. Also check VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates. If a compromise is suspected, save evidence before fixing anything where possible, including the VCO web access, backend application, system and database logs, along with the relevant file-system timestamps.
Arista bought the VeloCloud SD-WAN product line from Broadcom, announcing the deal in July 2025; the products were earlier known as VMware SD-WAN by VeloCloud. For the July and September flaws, Arista warned that a compromised orchestrator could also grant attackers access to VeloCloud Edge devices. For this flaw, the advisory does not say whether that risk applies or whether upgrading removes access an attacker has already gained.
Source: The Hackers News