Network teams running their own SD-WAN management plane have another urgent patch on the list. On October 22, 2026, Arista Networks disclosed CVE-2026-114625, an actively exploited SQL injection flaw in on-premises VeloCloud Orchestrator (VCO), the web portal used to configure and manage VeloCloud SD-WAN edges and gateways. The bug scores 9.9 on CVSS v3.1 and lets any logged-in user, even one with the lowest built-in tenant role, gain “superuser operator” privileges. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on October 23 with a federal remediation deadline of October 26, and it is the latest in a string of attacks on this one product this year. Here’s what the flaw does, how to tell if you’re exposed, and what to do today.
The Flaw: Read-Only Login to Superuser
According to Arista’s Security Advisory 0199, “any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user,” including access to internal-only functionality that was never meant to be reachable remotely. Since the orchestrator pushes configuration to every edge in the SD-WAN, that is effectively the keys to the whole network fabric.
The bar for attackers is low. Arista says exploitation requires network access to the VCO web interface and a valid session, and the minimum role needed is Enterprise Read Only. Arista adds that VCO is exposed by default and “there is no configuration that can prevent the exposure.” Arista detected the issue itself and confirmed it is known to be actively exploited, though it has not named the attackers or said how many customers were hit.
Affected Versions and Fixes
Only the self-hosted orchestrator is at risk. Arista says hosted and dedicated VCO instances have already been patched, and its EOS switches, VeloCloud Edges and VeloCloud Gateways are not affected. The vulnerable on-prem releases and their fixes are:
- VCO 5.2.x: versions before 5.2.3.18 are vulnerable. Upgrade to 5.2.3.18 or later.
- VCO 6.1.x: versions before 6.1.3.10 are vulnerable. Upgrade to 6.1.3.10 or later.
- VCO 6.4.x: versions before 6.4.2.12 are vulnerable. Upgrade to 6.4.2.12 or later.
- End-of-support releases: Arista has not assessed them and asks customers on unsupported trains to contact its TAC about upgrade options.
Indicators of Compromise to Hunt For
Because exploitation was already happening before the fix, patching alone is not enough. Arista recommends reviewing VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates. It has also shared two IP addresses observed in the attacks, which The Hacker News reports are geolocated to Japan:
- 74.82.197.86: block it and search your logs for any past connections.
- 38.54.50.151: block it and search your logs for any past connections.
If compromise is suspected, Arista advises preserving VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediation where possible, so the evidence survives the upgrade.
Why It Matters: A Repeat Target
This is not a one-off. According to The Hacker News, CVE-2026-114625 is the third vulnerability in VCO exploited in the wild since July 2026, following CVE-2026-16812 and CVE-2026-93952. BleepingComputer counts it as Arista’s fourth exploited zero-day of the year when an EOS flaw from May is included. Management planes like SD-WAN orchestrators are attractive because one foothold reaches every branch, and attackers clearly know where this one lives.
CISA’s October 23 KEV update came alongside another exploited flaw worth checking if you host collaboration tools: CVE-2026-110447 in the Collabora Online Built-in CODE Server for Nextcloud, a CVSS 9.2 command injection flaw in its proxy.php component, fixed in version 26.4.303. Both KEV entries carry the same October 26 federal deadline.
What to Do Today
Arista’s guidance, plus standard edge-device hygiene, gives a clear to-do list for network admins and MSPs managing VeloCloud deployments:
- Upgrade now: move on-prem VCO to 5.2.3.18, 6.1.3.10, 6.4.2.12 or later.
- Lock down the portal: restrict access to the VCO web interface to trusted administrative networks only.
- Audit accounts: since any login is enough, review who holds VCO credentials, including read-only and tenant users, and rotate anything that may have been exposed.
- Review admin activity: look for unexpected configuration changes, new accounts or privilege changes.
- Watch outbound traffic: monitor the VCO host for unexpected outbound connections and consider blocking outbound ports it doesn’t need.
- Hunt for persistence: check for backdoor daemons and web shells, which Arista specifically calls out.
Looking Ahead
Three exploited flaws in one management product in about four months is a strong signal that attackers are actively studying VeloCloud Orchestrator, and more research into it is likely. Organizations that self-host the orchestrator should treat it like any other internet-facing edge device: patched quickly, reachable only from admin networks, and monitored closely.
For teams weighing their options, Arista’s note that hosted VCO instances were patched before disclosure is also worth considering. Whether the orchestrator stays on-prem or moves to a hosted model, the lesson is the same: the box that controls every branch deserves the tightest access controls in the network.
Sources:
- Arista Networks Security Advisory 0199, October 22, 2026
- CISA, October 23, 2026
- BleepingComputer, October 22, 2026
- The Hacker News, October 24, 2026
