CVE-2026-114625: A Read-Only Login Is Enough to Own Arista VeloCloud Orchestrator

Arista's VeloCloud Orchestrator is the console that provisions and monitors an SD-WAN fabric. On 22 October 2026 the vendor published Security Advisory 0199 for CVE-2026-114625, an SQL injection classified as CWE-89 with a CVSS 3.1 score of 9.9 and a CVSS 4.0 score of 9.4. Arista states that the flaw is known to be actively exploited. The detail that should reset how teams think about tenant accounts is the privilege requirement: the lowest built-in customer role, Enterprise Read Only, is sufficient.

What the flaw actually permits

The advisory describes an authenticated user reaching operator privileges and masquerading as a local "superuser operator". That role exists to manage the orchestrator itself, not a single tenant, so the boundary between "a customer who can read dashboards" and "an operator who controls the platform" collapses once the injection succeeds. Arista also warns that successful exploitation may affect the VCO host, allowing access to internal-only functionality that was never meant to be reachable from the network.
Two consequences follow. First, a leaked read-only credential is no longer a low-severity finding. Second, the blast radius is the fabric, not the account. VeloCloud Orchestrator holds the policy, topology and device inventory for every branch it manages, so an operator-level session can observe or reshape wide-area traffic.

Exploitation preconditions

The attacker needs network reachability to the orchestrator web interface and one valid login. Arista's advisory does not describe a configuration that removes the exposure, and the reporting states that VCO is reachable by default. There is no unauthenticated path documented for this specific CVE, which distinguishes it from the two earlier VCO flaws exploited in July and September 2026.
The advisory does not disclose when exploitation began, which orchestrators were targeted, or what post-exploitation activity occurred. Treat those gaps as unknown rather than absent.

Affected releases

Three on-premises release trains are affected:

• 5.2.x before 5.2.3.18
• 6.1.x before 6.1.3.10
• 6.4.x before 6.4.2.12 Hosted and Dedicated VCO deployments were impacted and have already been patched by Arista. VeloCloud Gateway and VeloCloud Edge are not affected. Release trains outside the advisory list, including 7.0, are not listed as vulnerable; Arista notes that end-of-support releases were not checked, so unsupported deployments should be treated as unknown. A trap worth calling out: orchestrators that were updated to fix the July and September flaws remain vulnerable here, because those builds predate the new fixed releases on the same train.

Remediation and containment

Upgrade on-premises VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12. If the deployment sits on an unsupported train, contact Arista TAC for an upgrade path instead of assuming immunity.
Until the upgrade completes, Arista recommends restricting the orchestrator web interface to trusted administrative networks, blocking outbound ports normal operation does not require, monitoring for backdoor daemons and web shells, and reviewing recent administrator activity. Two IP addresses have been reported in connection with the attacks: 74.82.197.86 and 38.54.50.151. Search VCO and perimeter logs for them, and preserve logs and file timestamps before patching if compromise is suspected.

Exposure context

A ZoomEye query for the product title fingerprint, title="VeloCloud", returned 520 matching assets when executed on 22 October 2026. That number describes hosts advertising a VeloCloud-related title, not hosts confirmed to run an affected build or to be exploitable. It is a sizing signal for how much of this product family is visible from the public internet, and it argues for checking which of those interfaces genuinely need inbound access.

References

• Arista Security Advisory 0199: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
• CVE.org record for CVE-2026-114625: https://cveawg.mitre.org/api/cve/CVE-2026-114625
• The Hacker News, "Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks": https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html
• SecurityOnline, "Arista Warns VeloCloud Orchestrator Flaw CVE-2026-114625 Is Exploited in the Wild": https://securityonline.info/velocloud-orchestrator-cve-2026-114625-exploited/