Arista VeloCloud Orchestrator Zero-Day: Patch the SD-WAN Control Plane Now
Arista VeloCloud Orchestrator Zero-Day: Patch the SD-WAN Control Plane Now
Arista has confirmed active exploitation of CVE-2026-114625, a critical SQL injection flaw in on-premises VeloCloud Orchestrator (VCO). The vulnerability is rated CVSS 9.9 and has now been added to CISA's Known Exploited Vulnerabilities catalog.
The dangerous detail is the privilege boundary: an attacker with a valid VCO session, including the built-in Enterprise Read Only role, can gain operator privileges and impersonate the local superuser operator. That puts the SD-WAN management plane—not merely one application account—inside the incident-response scope.
What changed
Arista published Security Advisory 0199 on October 22, 2026. Its advisory says the issue was detected by Arista and is known to be actively exploited. The CVE record classifies it as CWE-89, and describes impact to the confidentiality, integrity, and availability of the VCO host and the data managed by the orchestrator.
On October 23, the Canadian Centre for Cyber Security reported that CISA had added the CVE to KEV. This changes the operational priority: organizations should treat exposure as a time-sensitive remediation and investigation task, not as a vulnerability to schedule for the next maintenance cycle.
Who is affected
The affected product is VeloCloud Orchestrator On-Prem in these release trains:
| Affected versions | Fixed version |
|---|---|
| 5.2.0 through before 5.2.3.18 | 5.2.3.18 or later |
| 6.1.0 through before 6.1.3.10 | 6.1.3.10 or later |
| 6.4.0 through before 6.4.2.12 | 6.4.2.12 or later |
Arista says hosted, including Dedicated, VCO environments were affected but have already been patched. VeloCloud Gateway and Edge are not the affected product in this advisory. Organizations running unsupported release trains should contact Arista for an upgrade path rather than assume that an older build is safe.
Why a read-only login is enough
The attack requires network access to the VCO web interface and a valid authenticated session, but not an administrator account. A low-privilege tenant identity can cross into functionality intended only for internal use and masquerade as a local superuser operator.
That is a classic privilege escalation problem in a central control plane. VCO can manage policy and configuration across an SD-WAN estate, so the blast radius is potentially broader than the host running the vulnerable service. The advisory does not provide a public proof of concept or confirm a specific post-exploitation payload; defenders should not invent either detail.
Immediate defensive actions
1. Inventory every on-premises VCO
Record the exact version and release train for every self-managed orchestrator. Do not close the ticket because a September VCO update was installed: the fixed floors for this CVE are later builds.
2. Patch to the matching fixed build
Upgrade to 5.2.3.18, 6.1.3.10, or 6.4.2.12—or a later supported build in the same train. Restrict the management interface to trusted administration networks or a VPN while the upgrade is being scheduled, but treat network restriction as a temporary control rather than a substitute for patching.
3. Hunt before you clean up
Arista published two source addresses observed in attack traffic: 74.82.197.86 and 38.54.50.151. Search VCO web-access, application, system, and database logs for these addresses and for:
- unusual URL-like path components or encoded characters;
- references to local or internal services;
- sudden high request rates;
- unexpected operator or superuser activity;
- new accounts, changed permissions, or unexplained SD-WAN policy changes.
The addresses are useful indicators, not a complete allowlist of attacker infrastructure. Their absence does not prove that a VCO instance is clean.
4. Preserve evidence and review the estate
If suspicious activity is found, preserve logs and relevant file-system timestamps before remediation where operationally feasible. Review recent configuration and policy changes across managed edges, rotate exposed VCO credentials and API tokens, and check for unexpected outbound connections or new services on the VCO host.
Patching removes the vulnerable condition; it does not automatically reverse a privileged change made during exploitation. This is why incident response and exposure management must run alongside the upgrade.
The operational lesson
VCO is a management plane with a large concentration of trust. A valid low-privilege session becoming a local superuser is more consequential than the same flaw in an isolated business application. Teams should therefore track orchestrator versions as critical infrastructure, monitor privileged management-plane actions, and test how quickly they can isolate the interface without disrupting the WAN.
The practical decision is clear: identify every on-prem VCO, patch the affected release train, and investigate for unauthorized operator activity before declaring the incident closed.
References
FAQ
Arista has confirmed active exploitation of CVE-2026-114625, a critical SQL injection flaw in on-premises VeloCloud Orchestrator (VCO). The vulnerability is rated CVSS 9.9 and has now been added to CISA's Known Exploited Vulnerabilities catalog.
Record the exact version and release train for every self-managed orchestrator. Do not close the ticket because a September VCO update was installed: the fixed floors for this CVE are later builds.