Securify

Arista Networks has disclosed yet another critical zero-day vulnerability in its VeloCloud Orchestrator (VCO) platform — the third actively exploited flaw to hit the SD-WAN management tool since July. Tracked as CVE-2026-114625 with a near-maximum CVSS score of 9.9, the SQL injection bug lets any authenticated user escalate to superuser-level operator privileges. Patches dropped on October 23, but with attackers already in the wild, administrators running on-premises VCO deployments face an urgent race to update.

What the Flaw Does

CVE-2026-114625 is a remotely exploitable SQL injection vulnerability in VeloCloud Orchestrator’s web interface. According to Arista’s advisory, a user with nothing more than the lowest built-in tenant role can exploit the flaw to gain full operator privileges, effectively masquerading as a local “superuser operator.” That grants access to internal-only management functions that control the orchestrator itself and every SD-WAN edge device it manages.

The implications are severe. Confidentiality, integrity, and availability of VCO — and all of the data it orchestrates — are at risk. Because VCO acts as the centralized brain for an organization’s entire SD-WAN deployment, compromising it can give attackers a foothold across every branch office, data center, and cloud gateway connected to the network.

Perhaps most concerning: Arista says that VCO deployments are exposed by default, and “there is no configuration that can prevent the exposure.” If the web interface is reachable and an attacker holds even a low-privilege account, exploitation is possible.

Active Exploitation Confirmed

Arista confirmed the vulnerability is actively exploited, though the company has not attributed the attacks to any specific threat actor. SecurityWeek reports that exploitation has been observed from at least two IP addresses — 74.82.197.86 and 38.54.50.151 — though additional source addresses are likely. The company has not disclosed when attacks began or how many organizations have been compromised.

All VCO releases before versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected. Hosted and Dedicated VCO deployments have already been patched by Arista. On-premises customers must update immediately.

A Pattern That Should Alarm Defenders

What makes this disclosure especially alarming is the pattern. CVE-2026-114625 is the third zero-day to hit VeloCloud Orchestrator in just four months, each one actively exploited before patches were available:

• July 2026 — CVE-2026-16812 (CVSS 10.0): An unauthenticated OS command injection flaw that required no credentials at all. VCO was exposed by default with no configuration workaround. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog and ordered U.S. federal agencies to patch by July 30. Attacker indicators included three IP addresses and IOCs such as suspicious files and outbound traffic from the VCO host.
• September 2026 — CVE-2026-93952 (CVSS 10.0): Another unauthenticated remote exploitation flaw, this time affecting orchestrators configured for certificate-based authentication from Edge devices. Arista published IOCs including backdoor files (/usr/local/sbin/.vcnode.js and /usr/local/sbin/vc-sysmond), a rogue systemd service, and a custom nginx header. Critically, builds that had been patched for the July flaw were still vulnerable to this one.
• October 2026 — CVE-2026-114625 (CVSS 9.9): The latest SQL injection, requiring only a low-privilege authenticated session. Patches released October 23.

The cadence is striking: each new flaw arrives roughly six to eight weeks after the last, and each has been exploited in the wild before disclosure. For organizations that patched promptly after each advisory, the window between “secure” and “vulnerable again” has been disturbingly narrow.

Why VeloCloud Orchestrator Is a High-Value Target

VeloCloud Orchestrator is the management plane for Arista’s SD-WAN solution, originally developed by VeloCloud Networks (acquired by VMware in 2017, and later inherited by Broadcom and spun off to Arista). It is used by enterprises and managed service providers worldwide to provision, monitor, and control SD-WAN edge appliances across distributed networks.

Compromising VCO is the equivalent of capturing an SD-WAN network’s command center. An attacker with operator or superuser access can reconfigure routing policies, intercept traffic, push malicious configurations to edge devices, disable security policies, or use the orchestrator as a pivot point deeper into corporate networks. The platform’s centralized nature makes it a single point of compromise with a blast radius that extends to every managed site.

What Administrators Should Do Now

Arista’s guidance is unambiguous: patch immediately. For on-premises deployments, the fixed versions are VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12 or later. However, given the track record, patching alone may not be sufficient. Arista and security researchers recommend the following steps:

• Restrict VCO access. Limit the web interface to trusted administrative networks. It should not be exposed to the public internet.
• Block known attacker IPs. Add 74.82.197.86 and 38.54.50.151 (October campaign), as well as IPs from the July and September advisories, to blocklists.
• Hunt for compromise. Review web access logs for unusual URL-like path components, encoded characters, high request rates, and references to internal services. Check for IOCs from all three advisories, including backdoor files, rogue services, and suspicious nginx headers.
• Preserve evidence before remediating. If compromise is suspected, capture web access logs, backend application logs, system logs, database logs, and filesystem timestamps before applying patches or rebuilding.
• Assume breach and rotate. For any instance that may have been compromised, rotate all credentials, validate managed edge devices, and consider restoring from a known-good backup rather than simply patching in place.

What to Watch Next

Three zero-days in four months is not a coincidence — it is a campaign, or at least a sustained focus by sophisticated attackers on a high-value target. The VeloCloud Orchestrator codebase is clearly under active scrutiny, whether by a single threat actor cycling through attack surfaces or by multiple groups drawn to a platform that offers outsized rewards for compromise.

Defenders should expect further disclosures. Organizations that rely on VeloCloud SD-WAN should treat their VCO instances as critical infrastructure in their own right, with continuous monitoring, segmented access, and an incident response plan that accounts for total orchestrator compromise. CISA has not yet added CVE-2026-114625 to the KEV catalog as of this writing, but given the precedent set by the July and September flaws, a KEV listing and a federal patching deadline are likely imminent.

The broader lesson extends beyond VeloCloud. Any centralized management platform — whether for SD-WAN, firewalls, or cloud infrastructure — represents a high-value, high-impact target. When that platform is internet-facing by default and manages an entire network topology, every vulnerability in it is an enterprise-wide emergency.