# Arista VeloCloud Orchestrator Zero-Day Under Active Attack: Patch Now - URL: https://usa-24.com/arista-velocloud-zero-day-exploited/ - Publisher: USA 24 - Section: Cybersecurity - Published: 2026-10-23T05:37:41.383Z - Updated: 2026-10-23T05:37:41.393Z - Topics: Zero-Day Vulnerabilities, SD-WAN Security, Arista Networks, Patch Management, Network Security > Attackers are exploiting a CVSS 9.9 SQL injection zero-day in on-premises VeloCloud Orchestrator. Arista's fixed releases are rolling out, and two attacker IP addresses are known. ## Key takeaways - Arista's October 22, 2026 advisory says attackers are actively exploiting CVE-2026-114625, a CVSS 9.9 SQL injection zero-day in on-premises VeloCloud Orchestrator. - Any user who can log in, including a read-only customer account, can gain operator privileges through the flaw. - Fixed on-prem releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later, while hosted and Dedicated orchestrators were already patched. - This is the third VeloCloud Orchestrator flaw Arista has reported as exploited since July, and earlier fixes do not cover this bug. - Arista cited attacks from 74.82.197.86 and 38.54.50.151 and recommends blocking both addresses. ## What Arista disclosed about CVE-2026-114625 Attackers are already exploiting a critical flaw in Arista's VeloCloud Orchestrator. Arista disclosed the bug in an advisory dated Thursday, October 22, and tracks it as CVE-2026-114625. The issue is a SQL injection zero-day in the on-premises version of the console that manages VeloCloud SD-WAN networks, and it carries a CVSS score of 9.9. [The Hacker News](https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html) reports that anyone who can log in, including someone with a read-only customer account, can gain operator privileges. According to [Security Online](https://securityonline.info/velocloud-orchestrator-cve-2026-114625-exploited/), an authenticated user can impersonate a local superuser operator and reach internal-only functions without any user interaction. Arista's advisory, as Security Online quotes it, says the flaw "was detected by Arista and is known to be actively exploited." The bar for an attacker is lower than it would be for a flaw that requires administrator credentials from the start. A basic account becomes an operator account, and that operator role sits inside the management console itself. ## Why the central console raises the stakes VeloCloud Orchestrator is the central management system for SD-WAN networks, so one compromised console can expose routing and policy controls across many branch offices. [Shattered](https://shattered.io/arista-velocloud-zero-day-cvss-10-2026/) reports that the product sits above thousands of branch-office edge devices, which means a takeover can reach an entire distributed network. Arista inherited the product when it bought VMware's SD-WAN business from Broadcom. For a company with branch offices spread across the country, that is the real exposure. A single console determines how many sites route traffic and which policies apply to each of them. ## Which VeloCloud Orchestrator versions get the fix Hosted and Dedicated orchestrators were patched before the advisory, so those customers do not need to act. [Cryptopolitan](https://www.cryptopolitan.com/arista-patches-exploited-velocloud-zero-day-as-sd-wan-risks-mount/) reports that Arista's on-premises fixes are split by release line, and the affected builds are listed below. | Release line | Affected builds | Fixed on-prem release | |---|---|---| | 5.2 | Before 5.2.3.18 | 5.2.3.18 | | 6.1 | Before 6.1.3.10 | 6.1.3.10 | | 6.4 | Before 6.4.2.12 | 6.4.2.12 and later | | 7.0 | Not on the affected list | No fix listed | Arista says releases not on its list are not vulnerable, which places the 7.0 train outside the advisory. The company has not assessed end-of-support releases, though. If your console runs one of those builds, the advisory gives no clean answer, so ask Arista directly before assuming you are covered. ## Why earlier patches left some networks exposed This is the third VeloCloud Orchestrator flaw Arista has reported as exploited since July. The first, CVE-2026-16812, was an unauthenticated command injection flaw rated CVSS 10.0 in July, according to [HivePro](https://www.hivepro.com/threat-advisory/critical-zero-day-hits-arista-velocloud-orchestrator). The second, CVE-2026-93952, carried the same top score and was disclosed on September 22 in Security Advisory 0183. At that point, fixes existed only for some release trains. [Network World](https://www.networkworld.com/article/4226139/on-prem-velocloud-orchestrator-under-attack-only-some-versions-patched.html) covered that gap directly in its reporting. Shattered also reports that CISA added the September flaw to its Known Exploited Vulnerabilities catalog the day it was disclosed, with a three-day deadline for federal agencies. The practical problem is that an earlier patch may not protect against this bug. Orchestrators on releases that fixed the earlier flaws remain vulnerable to CVE-2026-114625, because those releases predate the new fixes. An administrator who assumes the last update closed the door could leave the console open. ## Who carries the most risk right now Enterprises that run their own orchestrator carry most of the work. Managed service providers face a sharper version of the problem, because one on-prem console can serve several customers. If that console falls, every network it manages is in reach. Hosted customers have less to do here, since Arista patched those instances first. On-prem customers have to upgrade themselves, and the timing gap between disclosure and rollout is where the exposure sits. ## Steps to take now on on-prem VeloCloud Orchestrator - Inventory every on-prem VeloCloud Orchestrator instance and record its exact build number. Arista lists fixes by build, so a label like "6.1" alone is not enough. - Upgrade each instance to 5.2.3.18, 6.1.3.10, or 6.4.2.12 or later. - Restrict access to the management interface so that only trusted admin networks can reach it. - Block 74.82.197.86 and 38.54.50.151. [Cryptopolitan](https://www.cryptopolitan.com/arista-patches-exploited-velocloud-zero-day-as-sd-wan-risks-mount/) reports that Arista has seen attacks from these two addresses. - Review logs for new superuser or operator accounts, unexpected outbound connections, suspicious web requests and unusual admin activity. - If the console was running an older release when attacks began, ask Arista support how to hunt for compromise. If you find evidence of intrusion, rotate every credential the console holds. [Railway's breach](https://usa-24.com/railway-breach-rotate-secrets/) required the same response, with customers forced to rotate their secrets. ## What the sources still do not say The sources reviewed do not say when exploitation began or who is behind it. The July flaw left the same gap, according to HivePro. No one has published how many on-prem orchestrators are exposed or how many have been compromised. The sources also do not confirm whether CISA has added CVE-2026-114625 to its KEV catalog. Nothing in the reporting links the activity to a ransomware group or a nation-state actor. The reports disagree on whether the flaw needs a login. [SC World](https://www.scworld.com/brief/arista-networks-patches-actively-exploited-zero-day-vulnerability-in-velocloud-orchestrator) describes it as unauthenticated, while The Hacker News and Security Online describe a login requirement. The detailed advisory summaries match the login version, which this article follows, but readers should check Arista's full advisory before relying on either account. ## What to watch next Three developments will clarify the picture. The first is whether Arista publishes an exploitation timeline and identifies the attackers. The second is whether CISA adds CVE-2026-114625 to its KEV catalog, which would set a federal remediation deadline. The third is whether the 7.0 train stays outside the affected list as the investigation continues. The pattern also matters. Three exploited flaws in roughly three months will draw attention from defenders and attackers alike, and similar vendor emergencies have played out before, as USA 24 reported in its coverage of [Fortinet's urgent FortiOS patches](https://usa-24.com/fortinet-emergency-patch-fortios/). Teams that run VeloCloud consoles should treat this release as a reason to audit the whole fleet, not just the instance that alerted them. The next few days will show whether Arista's fixes and its advisories keep pace with the attacks. ## Frequently asked questions ### Do hosted VeloCloud Orchestrator customers need to patch CVE-2026-114625? No. Arista says its hosted and Dedicated orchestrators were patched before the October 22 advisory, so those customers do not need to take action. Only on-premises customers must upgrade, and they should move to 5.2.3.18, 6.1.3.10, or 6.4.2.12 or later. ### Which VeloCloud Orchestrator versions are affected by the zero-day? Arista lists 5.2 before 5.2.3.18, 6.1 before 6.1.3.10, and 6.4 before 6.4.2.12 as affected. The 7.0 release train is not on the list, and Arista says releases not on the list are not vulnerable. Arista has not assessed end-of-support releases, so ask the vendor before assuming an older build is safe. ### Is CVE-2026-114625 on CISA's Known Exploited Vulnerabilities list? The sources reviewed do not confirm a KEV listing for this flaw. CISA did add the earlier September flaw, CVE-2026-93952, to its catalog on the day it was disclosed, with a three-day federal deadline. Check the KEV catalog directly for updates. ### Does the VeloCloud flaw require a login to exploit? The detailed advisory summaries say yes: anyone who can log in, including a read-only customer account, can gain operator privileges. SC World's brief describes the flaw as unauthenticated, so the discrepancy should be checked against Arista's full advisory. Treat any account on the console as a possible path until you confirm the details. ## Sources 1. [Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks](https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html) 2. [Arista Networks patches actively exploited zero-day vulnerability in VeloCloud Orchestrator](https://www.scworld.com/brief/arista-networks-patches-actively-exploited-zero-day-vulnerability-in-velocloud-orchestrator) 3. [Arista Warns VeloCloud Orchestrator Flaw CVE-2026-114625 Is Exploited in the Wild](https://securityonline.info/velocloud-orchestrator-cve-2026-114625-exploited/) 4. [Arista patches exploited VeloCloud zero-day as SD-WAN risks mount](https://www.cryptopolitan.com/arista-patches-exploited-velocloud-zero-day-as-sd-wan-risks-mount/) 5. [On-prem VeloCloud Orchestrator under attack, only some versions patched](https://www.networkworld.com/article/4226139/on-prem-velocloud-orchestrator-under-attack-only-some-versions-patched.html) 6. [Critical Zero-Day Hits Arista VeloCloud Orchestrator](https://www.hivepro.com/threat-advisory/critical-zero-day-hits-arista-velocloud-orchestrator) 7. [Arista Zero-Day Hits CVSS 10.0, CISA Sets 3-Day Fix [2026]](https://shattered.io/arista-velocloud-zero-day-cvss-10-2026/)