CVE-2026-114625: Arista VeloCloud Orchestrator SQL injection (CVSS 9.9) exploited; fixed in 5.2.3.18, 6.1.3.10, 6.4.2.12

Arista Networks disclosed on 22 October 2026 that a SQL injection flaw in the on-premises VeloCloud Orchestrator (VCO), tracked as CVE-2026-114625 with a CVSS 3.1 score of 9.9, is already being exploited. It is the third VCO flaw the company has reported as exploited since late July, and the first that needs a login, though the bar is low: the lowest built-in customer role is enough. Orchestrators that already carry the fixes for the earlier two flaws are still vulnerable to this one.

Key points

• CVE-2026-114625 (Arista Security Advisory 0199, 22 October 2026) is a CWE-89 SQL injection in VeloCloud Orchestrator On-Prem, scored CVSS 3.1 9.9 and CVSS 4.0 9.4.
• Arista says it found the issue and that it is "known to be actively exploited"; it has not said when attacks began or who is behind them.
• Any authenticated user, down to the Enterprise Read Only role, can gain operator privileges, including impersonating the internal "superuser operator" account.
• Fixed releases: VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later; Hosted and Dedicated orchestrators were already patched by Arista.
• Arista lists two attacker IP addresses, 74.82.197.86 and 38.54.50.151, to block and search for in logs.

What to do

Who is affected. Only VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom) running one of: VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, or 6.4.x before 6.4.2.12. Arista says releases not listed are not affected, VeloCloud Gateway and Edge are not affected, and Hosted and Dedicated VCO instances have already been patched. Arista has not assessed end-of-support releases; those customers should contact Arista TAC about upgrade options.

Fix. Upgrade to VCO 5.2.3.18 or later on the 5.2 train, 6.1.3.10 or later on 6.1, or 6.4.2.12 or later on 6.4. Arista says VCO is exposed by default and no configuration setting prevents that exposure.

Until you can patch. Arista's advisory recommends restricting access to the VCO web interface to trusted administrative networks, watching for connections from the two listed IP addresses, watching for unexpected outbound traffic from the VCO host (and blocking outbound ports normal operation doesn't need), looking for backdoor daemons and webshells, and reviewing recent administrator activity for unexpected changes.

How to check whether you were hit. Search the VCO web access logs for unusual URL-like path components, encoded characters, references to local or internal services, and high request rates, and for the two IP addresses above. If you suspect compromise, Arista asks you to preserve web access, backend application, system and database logs and relevant file-system timestamps before you remediate, where that is practical.

What happened

On 22 October 2026 Arista published Security Advisory 0199 for VeloCloud Orchestrator On-Prem. The advisory describes a flaw that "may allow a remote attacker to access privileged internal functionality and impact the VCO host." In practice, any authenticated user can gain operator privileges and impersonate a local "superuser operator" account, including access to internal-only functions. Successful exploitation can compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.

The attacker needs network access to the VCO web interface and a valid session. The minimum role required is Enterprise Read Only, the lowest built-in tenant role, so an attacker does not need operator or administrator credentials, only some account on the orchestrator. The CVSS 3.1 vector, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflects that: network-reachable, low complexity, low privileges, no user interaction, changed scope and high impact on all three security properties. The CVSS 4.0 score is 9.4.

Arista says it found the issue and that it is known to be actively exploited. The advisory gives no start date for the attacks and no attribution. As of this writing we could not confirm from the sources we read whether CISA has added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog; the coverage we read does not mention it.

Background

VeloCloud is the SD-WAN product line that Arista bought from Broadcom, a deal announced in July 2025. The orchestrator is the central management system for the SD-WAN: it holds configuration and policy for the edge devices at branches and sites, which is why a compromised orchestrator is a high-value target.

According to The Hacker News, this is the third exploited VCO flaw Arista has reported since late July. The July flaw, CVE-2026-16812, was exploitable without a login, and Arista warned at the time that a compromised orchestrator could give an attacker access to VeloCloud Edge devices. The September flaw, CVE-2026-93952, was an improper-input-validation issue scored CVSS 10 that affected deployments using certificate-based authentication between Edge and the orchestrator; SecurityWeek reported that Arista said it was exploited, that an attacker needed the public part of an Edge authentication certificate and network access to the web interface, and that no VCO credentials were required. That advisory was published on 22 September and SecurityWeek reported that CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day.

How the fixes line up

Patching to the September fix does not protect against the October flaw. Per The Hacker News, the September fixes were 5.2.3.16 on the 5.2 train and 6.4.2.8 on the 6.4 train, while the October fixes are 5.2.3.18 and 6.4.2.12. An orchestrator on 5.2.3.16 or 6.4.2.8 is therefore still vulnerable and needs a second upgrade. On the 6.1 train, the September advisory covered releases up to 6.1.3.7, and the new fix is 6.1.3.10.

What it means

For network teams running VCO on-premises, the practical effect is a third emergency upgrade in under four months, on a product that Arista says is exposed by default with no setting to change that. The new flaw's requirement for a login narrows the attacker pool compared with the first two, but not by much: anyone holding a read-only customer account, including accounts on a multi-tenant orchestrator run by a managed service provider, could in principle escalate. Organisations that give customers or partners read-only logins should treat those accounts as a potential entry point until the fix is in.

The advisory leaves the question of Edge devices open. The earlier July advisory warned that a compromised orchestrator could reach Edge devices; The Hacker News notes that Arista has not said whether that risk applies here, or whether upgrading removes access an attacker already obtained. Administrators who find evidence of exploitation should therefore assume the orchestrator's data and credentials may have been exposed, and review what the orchestrator could change on managed devices, not just the orchestrator itself.

What we don't know yet

• When exploitation began, how many orchestrators were compromised, and who is behind the attacks. The advisory is silent on all three.
• Whether CISA has added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog. We could not confirm this.
• Whether upgrading to a fixed release removes persistence an attacker already established. Arista's advisory does not say.
• Whether the 6.1 train is also covered by the September fix. The Hacker News reports that neither advisory makes this clear.
• Whether end-of-support releases are affected; Arista has not assessed them.

What to watch next

Watch Arista's advisory page for a revision with more detail on the attacks, and CISA's Known Exploited Vulnerabilities catalog for an entry, which would set a deadline for US federal agencies. Also expect security vendors to publish detection rules based on the two listed IP addresses and the log patterns Arista describes.

Sources

• Arista Security Advisory 0199: VeloCloud Orchestrator (VCO) On-Prem, CVE-2026-114625 (primary source)
• The Hacker News: Arista warns of critical VeloCloud SQL injection zero-day exploited in attacks
• SecurityWeek: Arista urges immediate patching of exploited VCO zero-day (the September flaw, CVE-2026-93952)
• BleepingComputer: Arista patches new VeloCloud Orchestrator zero-day exploited in attacks (headline only; the page did not open for us)