Arista Networks disclosed on October 22, 2026 that attackers are already exploiting a critical SQL injection flaw in the on-premises edition of its VeloCloud Orchestrator, tracked as CVE-2026-114625 and scored CVSS 9.9. Any authenticated user with a basic login can climb to operator-level privileges. That makes this VeloCloud Orchestrator zero-day a management-plane problem for every branch the SD-WAN controller touches.
The pressure built fast. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 23, and reporting puts the federal remediation deadline at today, October 26. Teams that already run a CISA KEV patch workflow can move quickly. Everyone else is working against the clock.
This analysis covers what the Arista VeloCloud vulnerability does, which builds are safe, what the early indicators look like, and what the third exploited VCO flaw in four months says about the product. It also looks at the market angle, because Arista reports earnings in eight days.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Arista Disclosed on October 22
Arista published Security Advisory 0199 on October 22, 2026. The advisory describes a SQL injection vulnerability in VeloCloud Orchestrator (VCO) on-premises deployments and states that Arista detected exploitation in the wild. The company shipped fixes the same day across three release trains.
The Hacker News report on the advisory adds that the attack is low complexity and needs no user interaction. The Canadian Centre for Cyber Security followed on October 23 with its own alert (AV26-1080), which lists the pre-fix versions and confirms in-the-wild exploitation.
One naming note matters for searchers. Older articles call the product “VeloCloud Orchestrator by Broadcom.” Current reporting names Arista as the vendor and advisory publisher, and Arista has stated that it acquired the VeloCloud SD-WAN portfolio from Broadcom. If your runbooks still point at a Broadcom support path for VCO, update them.
| Date (2026) | Event |
|---|---|
| October 22 | Arista publishes Security Advisory 0199 and ships fixed on-prem builds |
| October 22 | Arista states the flaw is known to be actively exploited |
| October 22 | Hosted and Dedicated VCO already patched, per Arista |
| October 23 | CISA adds CVE-2026-114625 to the KEV catalog |
| October 23 | Canadian Centre for Cyber Security issues alert AV26-1080 |
| October 23 | SecurityWeek frames it as the third Arista VCO zero-day in four months |
| October 25 | Arista’s advisory page updated |
How CVE-2026-114625 Works
From SQL Injection to Superuser Operator
SQL injection happens when an application builds a database query from untrusted input without separating code from data. An attacker feeds crafted input into a field the server trusts, and the database executes it. In VCO’s case, the injected query lets a logged-in user rewrite their own privileges.
The advisory language says an authenticated user can obtain operator privileges and impersonate a local “superuser operator.” Operator is the top tier in the orchestrator’s role model. Reporting also lists a CVSS v4.0 score of 9.4 alongside the v3.1 score of 9.9, which signals that the severity holds under the newer scoring method as well.
Why a Basic Login Is Enough
The prerequisite sounds reassuring until you map it to reality. A basic-privilege account on a VCO can belong to a read-only customer or partner user. Those accounts get handed to help-desk staff, contractors, managed service providers and monitoring integrations. A single phished credential or reused password now equals full orchestrator control.
That reframes the risk. The question for defenders is not whether an outsider can reach the login page. It is how many people and systems hold any VCO credential at all. Every one of them sits one SQL query away from operator.
Who Is Affected: Versions, Fixed Builds and Exposure
Three release trains carry the flaw. VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12 are affected. Fixed builds are 5.2.3.18, 6.1.3.10 and 6.4.2.12, plus anything later in each train. VeloCloud Gateway and VeloCloud Edge are not affected, which narrows the blast radius to the controller itself.
| Component | Status as of October 22-26 | Action |
|---|---|---|
| VCO on-prem 5.2.x | Affected before 5.2.3.18 | Upgrade to 5.2.3.18 or later |
| VCO on-prem 6.1.x | Affected before 6.1.3.10 | Upgrade to 6.1.3.10 or later |
| VCO on-prem 6.4.x | Affected before 6.4.2.12 | Upgrade to 6.4.2.12 or later |
| Hosted VCO | Affected, already patched by Arista | Confirm with your provider |
| Dedicated VCO | Affected, already patched by Arista | Confirm with your provider |
| VeloCloud Gateway | Not affected | None for this CVE |
| VeloCloud Edge | Not affected | None for this CVE |
Be careful with the claim that every VCO is unpatched. It is wrong. Per BleepingComputer’s coverage, Arista says hosted instances, dedicated ones included, were affected but had already been patched by the advisory date. The exposed population is customers who run the orchestrator themselves.
No source reviewed for this piece gives a count of internet-reachable on-prem VCO servers. Other appliance bugs get that treatment quickly, as with the Citrix NetScaler flaw that reached KEV, so a scanning vendor will probably publish one soon. Until a figure arrives with its methodology, treat numbers floating around social media as unverified.
Arista’s Own Words on the VeloCloud Orchestrator Zero-Day
Arista’s advisory is blunt for a vendor document. The text, as reproduced by OpenCVE, states: “VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host.” That sentence tells you the damage is not confined to the web application. The underlying host is in play.
The same OpenCVE entry carries Arista’s consequence statement: “Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.” All three legs of the security triad appear in one sentence. For an SD-WAN controller, data managed by the orchestrator includes site configurations, policies and device inventories.
On exploitation, Arista said in its advisory, as quoted by SecurityWeek: “This issue was detected by Arista and is known to be actively exploited.” Two details stand out. Arista found the activity itself, so this was not a researcher report that later turned out to be weaponized. And the company chose to say actively exploited in plain text instead of hedging.
Active Exploitation and Reported Indicators of Compromise
Reporting identified two IP addresses tied to exploitation attempts: 74.82.197.86 and 38.54.50.151. Several outlets repeated them, and advisory coverage includes them as starting points for log review. Treat them as leads, not a complete list. Attackers rotate infrastructure, and a clean search for these two addresses proves little.
# Reported source IPs tied to CVE-2026-114625 exploitation attempts
74.82.197.86
38.54.50.151
# Quick sweep of reverse proxy and VCO web logs (adjust paths to your install)
grep -E "74\.82\.197\.86|38\.54\.50\.151" /var/log/nginx/access.log*The better hunt is behavioral. Look for accounts that changed role to operator without a change ticket, for new operator-level users, and for unusual query strings hitting the VCO web interface from low-privilege sessions. A read-only user who suddenly performs write actions is the signature of this attack path.
Patching does not undo a compromise. If exploitation preceded your upgrade, the attacker may already hold operator credentials, API tokens or configuration copies. Rotate secrets stored in or reachable from the orchestrator after the patch lands.
CISA KEV Listing and the Federal Deadline
CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities catalog on October 23, one day after Arista’s advisory. Available reporting states the remediation deadline for federal civilian agencies was October 26, 2026. That is a three-day window, the same compressed pattern seen when the Citrix NetScaler zero-days drew a 3-day deadline in September.
KEV status matters beyond government. Cyber insurers, auditors and customer security questionnaires increasingly treat a KEV entry as the line between known risk and negligent exposure. A private company that left a KEV-listed bug unpatched after the deadline has a harder story to tell after an incident.
Teams that prioritize by score alone can miss this. CVSS tells you how bad a flaw could be, while KEV tells you attackers are using it today. The trade-offs between those signals are laid out in a breakdown of EPSS, CVSS and CISA KEV triage. CVE-2026-114625 scores high on both, so the ranking is easy this time.
Third Arista VCO Zero-Day in Four Months
SecurityWeek’s headline calls this the third Arista VCO zero-day exploited in four months. That count is a media characterization. Arista’s official advisory chronology does not state it, so cite it as reporting and not as a vendor admission. The pattern still deserves attention, because three exploited flaws in one product line is a trend and not a fluke.
Why September’s Fixes Do Not Cover This One
Reporting references an earlier September 2026 VCO vulnerability, CVE-2026-93952, reportedly fixed in builds 5.2.3.16 and 6.4.2.8. Those builds do not protect against CVE-2026-114625. The October fixes are later releases in each train, so an orchestrator patched last month still needs another upgrade now. WebProNews made the same point in its write-up on orchestrators patched in September.
For operators this means the “we patched in September” answer is obsolete. Ask for the exact build number, not a yes or no.
Why SD-WAN Orchestrators Attract Attackers
An orchestrator is the brain of an SD-WAN fabric. It pushes policy to edge appliances, holds site and tunnel configuration, and often stores credentials for the devices it manages. Compromise it and you can reroute traffic, weaken segmentation or map an entire enterprise network from one console. An attacker gets the leverage of hundreds of branch devices without touching any of them.
Arista has also been building out this management layer. Its VeloCloud SD-WAN 7.0 documentation went up in August 2026, and the company has announced AI-driven Edge Threat Management for VeloCloud SD-WAN, managed through a single pane of glass in VCO, according to its own guides. More features routed through one console raise the value of that console to an attacker.
The role model is the weak joint here. Orchestrators carry tiered accounts (customer, partner, operator) because service providers need multi-tenant delegation. When a bug collapses those tiers, the multi-tenant design turns from a feature into an amplifier. Cisco’s SD-WAN manager has faced the same management-plane pressure, and the latest Cisco SD-WAN zero-day showed how fast a single controller bug becomes a fleet-wide problem.
Market Impact for Arista and Its VeloCloud Customers
Arista’s business is overwhelmingly data-center and AI networking, and the company is not hurting. It reported second-quarter 2026 revenue of $3.036 billion, up 37.7% from the same quarter of 2025, its first quarter above $3 billion. VeloCloud is a small slice of that story, so a single advisory will not move guidance.
| Arista metric | Figure | Period |
|---|---|---|
| Revenue | $3.036 billion | Q2 2026 (ended June 30) |
| Growth vs Q2 2025 | 37.7% | Q2 2026 |
| Growth vs Q1 2026 | 12.1% | Q2 2026 |
| Non-GAAP EPS growth, year over year | 40% | Q2 2026 |
| Q3 2026 results | Not yet released | Due Tuesday, November 3 |
The reputational question is narrower. Arista is positioning itself as an enterprise campus and branch vendor, and it earned a Leader placement in the 2026 Gartner Magic Quadrant for Enterprise Wired and Wireless LAN. Buyers evaluating Arista’s branch story now have an exploited, critical, privilege-escalation flaw in the SD-WAN controller to weigh. Expect procurement teams to ask for secure-development evidence in the next few renewal cycles.
For customers, the cost is operational. Emergency maintenance windows, credential rotation and log forensics eat engineering hours, and hosted-VCO customers avoid nearly all of it. Vulnerability-management vendors will use the episode in their pitches, a theme in the Tenable, Qualys and Rapid7 comparison, where exploit intelligence is a key differentiator.
Hosted vs On-Prem VCO: A Patch-Model Comparison
The disclosure splits VCO customers into two camps. Hosted and Dedicated customers got the fix before the public knew about the bug. On-prem customers learned about it at the same moment as everyone else, including the attackers. That is a strong argument for managed deployment, and it comes with its own trade-offs.
- Hosted or Dedicated VCO: Arista applies the patch, so exposure time shrinks. You trade away control over change timing and depend on the provider’s disclosure honesty.
- On-prem VCO: You control network placement and access lists, which can cut exposure to a handful of admin subnets. You also own every upgrade, and the October 22 fixes require action from you.
- Either model: Credential hygiene on low-privilege accounts matters, because this bug turns any of them into an operator account.
On-prem is not wrong. Regulated sectors often cannot move orchestration into a vendor cloud. But the Arista VeloCloud vulnerability shows the cost of that choice in concrete terms: a patch lag measured in days becomes the attacker’s window.
Historical Context: Management-Plane Zero-Days in 2026
VeloCloud is not alone. Attackers have spent 2026 working through the control planes of network vendors. A set of Cisco and SonicWall zero-days reached the KEV list earlier this month with a CVSS 10.0 in the mix.
F5 and Palo Alto have had their turns as well, as reports on the F5 BIG-IP zero-day and the PAN-OS root-access flaw show. The logic is consistent. Edge and management systems sit outside endpoint detection coverage, run appliance software that few teams monitor closely, and hold privileged access to everything behind them. SQL injection, one of the oldest bug classes, keeps surfacing in them because appliance code often predates modern secure-coding review.
Broadcom’s VMware line has seen the same dynamic play out in a different layer, with ransomware crews adopting a vCenter bug quickly enough that CISA gave agencies three days to respond. The lesson repeats across vendors. The gap between disclosure and mass exploitation keeps shrinking.
Patch and Hunt Checklist for On-Prem Operators
If you run VCO yourself, work this list in order. It assumes a small team and a short window.
- Confirm your build. Check the running version against 5.2.3.18, 6.1.3.10 and 6.4.2.12. Anything below its train’s fixed build is vulnerable.
- Upgrade now. Apply the fixed release for your train. Do not assume a September patch covers you.
- Restrict access. Limit the VCO web interface to administrative networks. Reporting lists this as a mitigation while you schedule the upgrade.
- Audit accounts. List every user with any VCO role. Disable dormant accounts and look for operator-level users nobody can explain.
- Review logs. Search for the two reported IPs and for low-privilege sessions that performed privileged actions.
- Rotate secrets. If anything suspicious appears, rotate credentials, API tokens and any device secrets the orchestrator stores.
- Record the evidence. Document the version, patch time and review results. Auditors and insurers will ask.
Teams that want this to run cleanly next time should define asset inventory, owners and deadlines before the next advisory lands. The cybersecurity section tracks other edge-device advisories in the same format.
Five Predictions for VeloCloud Security
These are analysis, not reporting. Each follows from the pattern above.
- Exploitation widens before patching does. Once researchers publish technical write-ups of the query path, opportunistic scanning for unpatched on-prem VCOs will rise. Expect more victims among organizations that treat the orchestrator as internal-only.
- Arista leans on hosted VCO. The patch-before-disclosure story for hosted customers is a sales argument. Look for Arista to push managed deployment harder in renewals.
- Analysts raise it on November 3. Arista reports Q3 2026 results that day. A question about VeloCloud security on the call is likely, though the financial impact should stay small.
- A fourth advisory arrives within months. Three exploited flaws in four months suggests attackers have mapped the product and are testing it. Researchers who found one query-handling bug rarely stop at one.
- Buyers demand management-plane isolation. Procurement language for SD-WAN will start requiring that the orchestrator sit behind dedicated admin access, with no direct internet exposure and no shared credentials.
Frequently Asked Questions
What is CVE-2026-114625? It is a critical SQL injection vulnerability in Arista’s on-premises VeloCloud Orchestrator, disclosed on October 22, 2026 and rated CVSS 9.9. An authenticated user with basic privileges can escalate to operator-level access.
Is the VeloCloud Orchestrator zero-day being exploited? Yes. Arista states it detected exploitation in the wild, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 23, 2026.
Which VCO versions are affected? On-prem releases before 5.2.3.18 in the 5.2 train, before 6.1.3.10 in the 6.1 train, and before 6.4.2.12 in the 6.4 train. Fixed builds are those versions or later.
Are VeloCloud Gateway and Edge affected? No. Reporting and the advisory say VeloCloud Gateway and VeloCloud Edge are not affected by this vulnerability. The risk sits in the orchestrator.
Do hosted VCO customers need to act? Arista states hosted and Dedicated VCO instances were affected but already patched by the time of disclosure. Ask your provider to confirm the build in writing.
Does the September VCO patch protect against this flaw? No. Reporting says the September fixes (5.2.3.16 and 6.4.2.8) addressed a separate vulnerability, CVE-2026-93952. The October releases are later builds and are required for CVE-2026-114625.
Who is the vendor now, Broadcom or Arista? Arista Networks. Current advisories and reporting name Arista as the vendor, and Arista has stated that it acquired the VeloCloud SD-WAN portfolio from Broadcom. Older articles using the “by Broadcom” label are out of date.
