Arista Networks published a security advisory on October 22 warning of active exploitation of the critical vulnerability CVE-2026-114625 in VeloCloud Orchestrator (VCO) — the central management system for VeloCloud SD-WAN networks. The SQL injection vulnerability (CWE-89) allows any authenticated user, including holders of the minimal Enterprise Read Only role, to escalate privileges to operator superuser level and gain access to internal functions not intended for remote use. The CVSS v3.1 score is 9.9, CVSS v4.0 — 9.4. Organizations with on-premises VCO deployments on branches 5.2, 6.1, and 6.4 need to immediately install the fixed versions or apply temporary protection measures.
Technical details of the vulnerability
According to the Arista advisory, exploiting CVE-2026-114625 requires two conditions: network access to the VCO web interface and a valid authenticated session. At the same time, the minimal built-in role — Enterprise Read Only, the lowest level of access for customer users — is sufficient. VCO is exposed to the internet by default, and no configuration setting allows this exposure to be eliminated.
Successful exploitation allows an attacker to operate as the local operator superuser — a role with full access to the orchestrator. This can lead to a compromise of the confidentiality, integrity, and availability of both the orchestrator itself and the data it manages. Arista also notes that exploitation may affect the VCO host system.
Affected versions and fixes
The vulnerability affects on-premises deployments of VeloCloud Orchestrator On-Prem (previously VeloCloud Orchestrator by Broadcom) in the following versions:
- VCO 5.2.x before version 5.2.3.18
- VCO 6.1.x before version 6.1.3.10
- VCO 6.4.x before version 6.4.2.12
The fixed versions are: VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12 respectively. Cloud (Hosted) and Dedicated VCO deployments have already received patches. The VeloCloud Gateway and VeloCloud Edge components are not affected by this vulnerability. The 7.0 branch is also not affected. Arista has not tested versions that have reached end of support — customers on such branches are advised to contact TAC to discuss upgrade options.
An important nuance: orchestrators that were updated to address the previous July and September vulnerabilities remain vulnerable to CVE-2026-114625, since those fixed versions predate the new patches.
Series of VCO vulnerabilities: context
CVE-2026-114625 is the third zero-day vulnerability in VeloCloud Orchestrator that Arista has reported since late July. In July, CVE-2026-16812 was disclosed — an OS command injection vulnerability (CWE-78) with a CVSS score of 10.0 that did not require authentication. In September, it was followed by CVE-2026-93952 — an input validation error (CWE-20) with CVSS 10.0, which also did not require credentials. Both previous vulnerabilities were added to the CISA KEV catalog as actively exploited.
We have already analyzed both previous vulnerabilities in detail: CVE-2026-16812 in VeloCloud Orchestrator and CVE-2026-93952 with CVSS 10.0.
The current vulnerability differs from the previous two in that it requires authentication. However, the entry barrier remains low: the Enterprise Read Only role is the minimal level of access granted to any customer user. In the VCO architecture, operators create customer and partner accounts, and each partner manages a group of customers. Thus, a compromised account at any level becomes a starting point for complete takeover of the orchestrator.
It is worth noting that at the time the October advisory was published, the fix for the September vulnerability CVE-2026-93952 for the 6.1 branch had still not been released — fixes were only available for the 5.2 and 6.4 branches. The advisory does not clarify whether version 6.1.3.10 also addresses the September vulnerability.
Indicators of compromise
According to Arista, attacks were conducted from two IP addresses:
- 74.82.197[.]86
- 38.54.50[.]151
Arista recommends blocking these addresses and checking logs for requests originating from them. Additionally, you should analyze VCO web access logs for requests with unusual path components, encoded characters, requests to local or internal services, as well as abnormally high request frequency.
The advisory does not disclose when the attacks began, which organizations were affected, or what actions the attackers performed after exploitation. It also does not state whether this vulnerability allows access to VeloCloud Edge devices — although for the July and September vulnerabilities Arista warned of this possibility.
Protection recommendations
If immediate updating is impossible, Arista recommends the following temporary measures:
- Restrict access to the VCO web interface to trusted administrative networks
- Monitor connections to VCO from known malicious IP addresses
- Monitor unusual outbound network activity from the VCO host
- Consider blocking outbound ports that are not required for normal operation
- Check for backdoors and web shells
- Analyze administrative action logs for unexpected changes
If compromise is suspected, Arista strongly recommends preserving evidence before starting any recovery work: VCO web access logs, server application logs, system and database logs, as well as file system timestamps.
Three critical zero-day vulnerabilities in VeloCloud Orchestrator in three months — all with confirmed active exploitation — paint a consistent picture of sustained pressure on SD-WAN infrastructure. Organizations with on-premises VCO deployments should treat upgrading to the fixed versions (5.2.3.18, 6.1.3.10, 6.4.2.12) as a top-priority task and in parallel conduct retrospective log analysis for signs of compromise using the listed IOCs.
