Arista Patches Exploited VeloCloud Zero-Day

Arista has released fixes for a critical flaw in on-premises VeloCloud Orchestrator that attackers are already exploiting, the company said on Wednesday. The bug, CVE-2026-114625, lets any logged-in user, even one with the lowest built-in role, take over operator-level control of the system that manages a company’s SD-WAN.

In Security Advisory 0199, Arista says the issue “was detected by Arista and is known to be actively exploited”. It rates the flaw 9.9 on CVSS version 3.1 and 9.4 on version 4.0. The 9.9 figure reported by SecurityOnline matches the version 3.1 score.

What the flaw does

The vulnerability is an SQL injection bug (CWE-89). “On an affected system, any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user,” the advisory says. That includes functions “intended for internal use only and which is not intended to be remotely accessible”.

“Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator,” Arista warns.

The bar for attackers is low. According to the advisory, VCO “is exposed by default”. An attacker needs network access to the web interface and a valid session, and the minimum role required is Enterprise Read Only. “There is no configuration that can prevent the exposure,” Arista says.

Arista has not said who is behind the attacks, how many customers are affected or when exploitation began.

Who is affected and the fixed versions

Only on-premises VeloCloud Orchestrator is affected, according to the advisory. Hosted versions, including Dedicated, “were impacted and have already been patched”. VeloCloud Gateway, VeloCloud Edge and Arista’s EOS-based products are not affected. Arista notes that end-of-support versions have not been assessed.

The affected and fixed releases are:

VCO 5.2.x releases prior to 5.2.3.18; fixed in VCO 5.2.3.18 and later in the 5.2 train
VCO 6.1.x releases prior to 6.1.3.10; fixed in VCO 6.1.3.10 and later in the 6.1 train
VCO 6.4.x releases prior to 6.4.2.12; fixed in VCO 6.4.2.12 and later in the 6.4 train

Customers on unsupported release trains are told to contact Arista’s Technical Assistance Center (TAC).

The fixes, the IPs to block and the logs to keep

Arista lists two IP addresses “observed conducting the attacks” and advises blocking them and checking logs for their presence:

74.82.197.86
38.54.50.151

Until the patch is applied, Arista recommends restricting the VCO web interface to trusted administrative networks, monitoring for unexpected outbound traffic, considering blocking outbound ports not needed for normal activities, watching for backdoor daemons and webshells, and reviewing recent administrator activity. Defenders should look in web access logs for “unusual URL-like path components, encoded characters, references to local or internal services, or high request rates”.

If compromise is suspected, Arista says operators should preserve VCO web access logs, backend application logs, system logs, database logs and file-system timestamps “before remediation where operationally feasible”. Patching first can wipe the evidence needed to show what an attacker did.

A fourth exploited Arista flaw this year, BleepingComputer says

BleepingComputer reported that this is the fourth actively exploited Arista zero-day patched this year, after CVE-2026-7473 in May, CVE-2026-16812 in July and CVE-2026-93952 in September. All three earlier flaws are listed in CISA’s Known Exploited Vulnerabilities catalogue: CVE-2026-7473 affects Arista EOS, while the other two affect VeloCloud Orchestrator. CISA added them on 9 June, 27 July and 22 September respectively. As of the 21 October catalogue, the new flaw was not yet listed, and no NVD or CVE.org record had been published.

Hosted customers are already safe; on-prem teams have a clear checklist

The plain risk is serious: a stolen read-only tenant password could become control of the system that manages traffic across many branch sites. But the defensive picture is better than the score suggests. Arista detected the issue itself, had already patched hosted instances when it disclosed the flaw, published fixed builds for all three supported trains on the same day, and gave defenders specific IPs and log patterns to hunt. That is the kind of advisory security teams can act on quickly.

The harder question is the pattern. Three exploited VeloCloud Orchestrator flaws since July, all in the same management product, which the advisory notes was formerly sold by Broadcom, suggest attackers are studying it closely. For on-prem customers, the lasting fix is architectural: keep the orchestrator off the open internet, cut the number of tenant accounts and treat every VCO login as a high-value credential. The same lesson ran through recent edge-gear attacks on Ivanti Connect Secure and Palo Alto’s PAN-OS.

Arista is better known to TSN readers for AI networking, such as its Etherlink racks for linking up to 144 AI chips. More on exploited flaws is in our ransomware and cyber attacks hub. The next signal to watch is whether CISA adds CVE-2026-114625 to its catalogue and sets a patch deadline for US agencies.