Arista Patches Exploited VeloCloud Orchestrator Zero-Day
Arista warned on October 22 that attackers are exploiting a zero-day in VeloCloud Orchestrator, the management system used for VeloCloud SD-WAN networks. The flaw allows an authenticated user with even a read-only customer account to obtain operator privileges, putting the confidentiality, integrity and availability of the orchestrator and its managed data at risk.
The vulnerability is tracked as CVE-2026-114625 and affects on-premises VeloCloud Orchestrator deployments. Exploitation requires network access to the orchestrator's web interface and a valid login, but the minimum required role is Enterprise Read Only. The attack uses SQL injection and does not require user interaction.
Administrators of on-premises deployments should upgrade to VCO 5.2.3.18, 6.1.3.10 or 6.4.2.12, matching their release train. Arista says hosted and dedicated orchestrators have already been patched. The 7.0 release train is not listed as affected, while releases that have reached end of support have not been checked.
The release decision needs extra care for organizations that recently updated VCO. Arista says releases that fixed earlier VCO flaws exploited in July and September remain affected because they predate the new fixes. Customers on unsupported release trains can contact Arista's Technical Assistance Center about upgrade options.
If an immediate upgrade is not possible, Arista recommends limiting VCO web access to trusted administrative networks and monitoring for connections from known malicious IP addresses. Teams should also review administrator activity and VCO web access logs for unusual URL-like path components, encoded characters, references to local or internal services, or high request rates.
The observed attack infrastructure includes 74[.]82.197.86 and 38[.]54.50.151, which Arista advises administrators to block and check against their logs. If compromise is suspected, preserve VCO web access, backend application, system and database logs, as well as relevant file-system timestamps, before remediation where operationally feasible.
The available advisory does not establish when the attacks began, which orchestrators were compromised or what attackers did after exploitation. It also does not say whether this incident carries the same risk of access to VeloCloud Edge devices that Arista described for the earlier July and September flaws. Those gaps make patching and focused log review more useful than assuming that a successful update alone explains prior activity.