What Arista disclosed about CVE-2026-114625
Attackers are already exploiting a critical flaw in Arista's VeloCloud Orchestrator. Arista disclosed the bug in an advisory dated Thursday, October 22, and tracks it as CVE-2026-114625. The issue is a SQL injection zero-day in the on-premises version of the console that manages VeloCloud SD-WAN networks, and it carries a CVSS score of 9.9.
The Hacker News reports that anyone who can log in, including someone with a read-only customer account, can gain operator privileges. According to Security Online, an authenticated user can impersonate a local superuser operator and reach internal-only functions without any user interaction. Arista's advisory, as Security Online quotes it, says the flaw "was detected by Arista and is known to be actively exploited."
The bar for an attacker is lower than it would be for a flaw that requires administrator credentials from the start. A basic account becomes an operator account, and that operator role sits inside the management console itself.
Why the central console raises the stakes
VeloCloud Orchestrator is the central management system for SD-WAN networks, so one compromised console can expose routing and policy controls across many branch offices. Shattered reports that the product sits above thousands of branch-office edge devices, which means a takeover can reach an entire distributed network. Arista inherited the product when it bought VMware's SD-WAN business from Broadcom.
For a company with branch offices spread across the country, that is the real exposure. A single console determines how many sites route traffic and which policies apply to each of them.
Which VeloCloud Orchestrator versions get the fix
Hosted and Dedicated orchestrators were patched before the advisory, so those customers do not need to act. Cryptopolitan reports that Arista's on-premises fixes are split by release line, and the affected builds are listed below.
| Release line | Affected builds | Fixed on-prem release |
|---|---|---|
| 5.2 | Before 5.2.3.18 | 5.2.3.18 |
| 6.1 | Before 6.1.3.10 | 6.1.3.10 |
| 6.4 | Before 6.4.2.12 | 6.4.2.12 and later |
| 7.0 | Not on the affected list | No fix listed |
Arista says releases not on its list are not vulnerable, which places the 7.0 train outside the advisory. The company has not assessed end-of-support releases, though. If your console runs one of those builds, the advisory gives no clean answer, so ask Arista directly before assuming you are covered.
Why earlier patches left some networks exposed
This is the third VeloCloud Orchestrator flaw Arista has reported as exploited since July. The first, CVE-2026-16812, was an unauthenticated command injection flaw rated CVSS 10.0 in July, according to HivePro. The second, CVE-2026-93952, carried the same top score and was disclosed on September 22 in Security Advisory 0183.
At that point, fixes existed only for some release trains. Network World covered that gap directly in its reporting. Shattered also reports that CISA added the September flaw to its Known Exploited Vulnerabilities catalog the day it was disclosed, with a three-day deadline for federal agencies.
The practical problem is that an earlier patch may not protect against this bug. Orchestrators on releases that fixed the earlier flaws remain vulnerable to CVE-2026-114625, because those releases predate the new fixes. An administrator who assumes the last update closed the door could leave the console open.
Who carries the most risk right now
Enterprises that run their own orchestrator carry most of the work. Managed service providers face a sharper version of the problem, because one on-prem console can serve several customers. If that console falls, every network it manages is in reach.
Hosted customers have less to do here, since Arista patched those instances first. On-prem customers have to upgrade themselves, and the timing gap between disclosure and rollout is where the exposure sits.
Steps to take now on on-prem VeloCloud Orchestrator
- Inventory every on-prem VeloCloud Orchestrator instance and record its exact build number. Arista lists fixes by build, so a label like "6.1" alone is not enough.
- Upgrade each instance to 5.2.3.18, 6.1.3.10, or 6.4.2.12 or later.
- Restrict access to the management interface so that only trusted admin networks can reach it.
- Block 74.82.197.86 and 38.54.50.151. Cryptopolitan reports that Arista has seen attacks from these two addresses.
- Review logs for new superuser or operator accounts, unexpected outbound connections, suspicious web requests and unusual admin activity.
- If the console was running an older release when attacks began, ask Arista support how to hunt for compromise. If you find evidence of intrusion, rotate every credential the console holds. Railway's breach required the same response, with customers forced to rotate their secrets.
What the sources still do not say
The sources reviewed do not say when exploitation began or who is behind it. The July flaw left the same gap, according to HivePro. No one has published how many on-prem orchestrators are exposed or how many have been compromised.
The sources also do not confirm whether CISA has added CVE-2026-114625 to its KEV catalog. Nothing in the reporting links the activity to a ransomware group or a nation-state actor.
The reports disagree on whether the flaw needs a login. SC World describes it as unauthenticated, while The Hacker News and Security Online describe a login requirement. The detailed advisory summaries match the login version, which this article follows, but readers should check Arista's full advisory before relying on either account.
What to watch next
Three developments will clarify the picture. The first is whether Arista publishes an exploitation timeline and identifies the attackers. The second is whether CISA adds CVE-2026-114625 to its KEV catalog, which would set a federal remediation deadline. The third is whether the 7.0 train stays outside the affected list as the investigation continues.
The pattern also matters. Three exploited flaws in roughly three months will draw attention from defenders and attackers alike, and similar vendor emergencies have played out before, as USA 24 reported in its coverage of Fortinet's urgent FortiOS patches. Teams that run VeloCloud consoles should treat this release as a reason to audit the whole fleet, not just the instance that alerted them. The next few days will show whether Arista's fixes and its advisories keep pace with the attacks.
