Exploited in the wildCRITICALCISA KEV

Arista VeloCloud Orchestrator zero-day lets low-privilege users take operator control

Any authenticated VCO On-Prem user, down to Enterprise Read Only, can escalate to operator. Arista and CISA confirm exploitation. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and check for compromise.

Arista Networks VeloCloud Orchestrator (VCO) On-PremCVE-2026-114625CVSS9.9CWE-89Edge & VPN
Published Oct 24, 2026

Arista detected the flaw being exploited as a zero-day and says so in its advisory. CISA added it to KEV on 2026-10-23 with a 2026-10-26 due date. No start date, victims or actor have been disclosed.

Oct 22, 20264 daysOct 26, 2026

What you need to know

  • Affects on-prem VeloCloud Orchestrator 5.2, 6.1 and 6.4 trains. Hosted and Dedicated VCO are already patched by Arista. Edge, Gateway and the 7.0 train are not listed.
  • Any logged-in user, including the lowest Enterprise Read Only role, can gain operator-level control of the orchestrator and possibly the host.
  • Exploited as a zero-day. Arista confirms it, CISA lists it in KEV with a 2026-10-26 deadline, and two attacker IPs are published.
  • Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. Fixes for the July and September VCO zero-days do not cover this one.
  • Hunt for connections from 74.82.197.86 and 38.54.50.151, unexpected outbound traffic from the VCO host, new daemons or webshells, and unexplained admin changes.

What's happening

CVE-2026-114625 is a privilege-escalation flaw in on-prem Arista VeloCloud Orchestrator (VCO), the management plane for VeloCloud SD-WAN deployments 1. An attacker with any valid VCO portal account can gain operator privileges and act as a local superuser operator 1,3. Operators sit at the top of the VCO hierarchy, where customer and partner accounts are created 3. It is rated CVSS v3.1 9.9 1,3, and Arista's advisory also lists a CVSS v4.0 score of 9.4 1. CISA classifies it as SQL injection (CWE-89) 2.

Fixed on-prem releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12 1,3. Arista says Hosted and Dedicated orchestrators were also affected and have already been patched, so those customers do not need to act 1,3. Per The Hacker News, orchestrators running the releases that fixed the July and September VCO flaws are still vulnerable to this one 3.

Arista says the issue "was detected by Arista and is known to be actively exploited" 6. CISA added it to KEV on 2026-10-23, gave a 2026-10-26 due date, and flagged forensic triage as required 2. Arista has published two source IPs seen in the attacks 3,4. It has not said when attacks began, which orchestrators were hit, what attackers did with operator access, or who is behind it 3,4. This is the third VCO flaw Arista has reported as exploited since July 2026, after CVE-2026-16812 and CVE-2026-93952 4,6.

How it works

Two sources label the flaw differently. CISA's KEV entry calls it SQL injection (CWE-89) in on-prem VCO 2. Arista's advisory describes privilege escalation that exposes functionality meant only for internal use and never meant to be remotely reachable 1. The retrieved advisory text does not use the term SQL injection 1. Arista has not given technical details on how the flaw is exploited 4, and no public root-cause analysis from researchers was found.

The attacker needs network access to the VCO web interface and an authenticated portal session 1. The minimum role is Enterprise Read Only, the lowest built-in tenant role 1,3. Arista says VCO is exposed by default and no configuration setting prevents the exposure 1,6. The July and September VCO zero-days did not require a login; this one does 3. In practice, any tenant user, any leaked low-privilege credential, or any account added by an earlier compromise is enough to start the attack.

Arista says successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages, and may impact the underlying VCO host 1. CISA's SSVC assessment rates technical impact as total and automatability as no 2. For the two earlier flaws, Arista warned that a compromised orchestrator could give access to managed VeloCloud Edge devices. It has not said whether that applies here 3.

What to do

In order of priority
  1. 1

    Upgrade on-prem VCO to a fixed release in its train: 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later 1. Fixes for CVE-2026-16812 and CVE-2026-93952 do not address this flaw 3.

  2. 2

    Customers on unsupported or end-of-support trains should contact Arista TAC for upgrade options, because Arista has not assessed those releases 3.

  3. 3

    Until patched, restrict the VCO web interface to trusted administrative networks, block the two published IPs, and block outbound ports that normal operation does not need 3.

  4. 4

    Audit VCO accounts. Remove unused tenant users and enforce strong authentication, because any authenticated account, including Enterprise Read Only, is a valid starting point 1.

  5. 5

    Treat unpatched, internet-reachable orchestrators as possibly compromised, since this was a zero-day. Run forensic triage as CISA requires and preserve logs before remediation 2,6. It is not known whether upgrading removes access an attacker already gained 3.

  6. 6

    After triage, rotate VCO operator, admin and API credentials, and review configurations pushed to managed Edges for unauthorized changes.

  7. 7

    US federal agencies must apply Arista's mitigations under BOD 26-04 by 2026-10-26, or discontinue the product if mitigations are unavailable 2.

Detection

  • Search firewall, proxy and VCO web access logs for connections from 74.82.197.86 and 38.54.50.151, the source IPs Arista published 3,4.
  • Watch the VCO host for unexpected outbound connections, new or unknown daemons that could be backdoors, and webshells under the web application directories 3.
  • Review recent administrator and operator activity in VCO for unexpected changes: new operator, partner or customer accounts, role changes, and configuration pushes to Edges 3.
  • In VCO web access logs, flag high request rates from one session and requests that contain encoded characters, embedded URL-style paths, or pointers to local or internal services 5,6.
  • Map which low-privilege accounts, especially Enterprise Read Only users, were active from unfamiliar IPs. Exploitation requires an authenticated session, so login records narrow the scope 1.
  • If compromise is suspected, preserve web access, backend application, system and database logs plus file-system timestamps before upgrading where feasible, and engage Arista TAC 5,6. CISA marks forensic triage as required for this CVE 2.

Indicators

As published by the cited sources
TypeValueContext
ip74.82.197.86Published by Arista as a source of the attacks; geolocates to Japan per The Hacker News.4
ip38.54.50.151Published by Arista as a source of the attacks; geolocates to Japan per The Hacker News.4

Timeline

  1. Arista publishes Security Advisory 0199 with fixed on-prem releases, confirms active exploitation, and reports Hosted/Dedicated VCO already patched. 1

  2. The Hacker News and BleepingComputer report the exploited zero-day; The Hacker News notes that, unlike the earlier two, it requires authentication. 3

  3. CISA adds CVE-2026-114625 to KEV with a 2026-10-26 due date and flags forensic triage as required. 2

  4. SecurityWeek reports the third exploited VCO zero-day in four months. 6

  5. The Hacker News reports the KEV addition and the two Japan-geolocated attacker IPs Arista published. 4

  6. CISA KEV remediation deadline for US federal agencies. 2

Sources

  1. 1
    Security Advisory 0199
    Arista Networks · Vendor · Oct 22, 2026
  2. 2
    CISA KEV catalog entry for CVE-2026-114625
    CISA · Government · Oct 23, 2026
  3. 3
    Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
    The Hacker News · News · Oct 22, 2026
  4. 4
    CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
    The Hacker News · News · Oct 24, 2026
  5. 5
    Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
    BleepingComputer · News · Oct 22, 2026
  6. 6
    Attackers Exploit Third Arista VCO Zero-Day in Four Months
    SecurityWeek · News · Oct 23, 2026

Confirmed by vendor and government. Researched and drafted by the VulnDigest briefs agent from 6 sources, then checked against them by a separate review step on Oct 24, 2026.

Arista's advisory describes privilege escalation and does not use the term SQL injection; the CWE-89/SQL injection label comes from CISA and press reports.

Fixed versions (5.2.3.18, 6.1.3.10, 6.4.2.12) are confirmed by The Hacker News, BleepingComputer and SecurityWeek, all relaying Arista; the advisory page itself returned limited text when checked.

The KEV date added (2026-10-23), forensic-triage flag, BOD 26-04 reference and SSVC values come from CISA's KEV feed; one other data source lists 2026-10-22 as the date added. The 2026-10-26 due date is confirmed by press.

No public proof-of-concept exploit has been found. The exploited status rests on Arista's own detection and CISA's KEV listing.

Still unknown: when exploitation began, victims, what attackers did after escalating, attribution, whether managed Edges are at risk, and whether upgrading removes existing attacker access.

Spotted an error? Open an issue on sochub.io.