Arista VeloCloud Orchestrator on-prem CVE-2026-114625 (CVSS 9.9): SQL injection lets any authenticated user, down to the Enterprise Read Only role, gain operator privileges; Arista says it is actively exploited and has fixed it in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12

Arista Security Advisory 0199 (22 October 2026) documents CVE-2026-114625, an SQL injection flaw (CWE-89) in on-premises VeloCloud Orchestrator (VCO), the management portal for VeloCloud SD-WAN. Arista says any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user, reaching functionality meant for internal use only, and that successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. An attack needs network access to the VCO web interface and a valid authenticated session; the minimum role is Enterprise Read Only, the lowest built-in tenant role, and Arista says no configuration prevents the exposure. Arista says the issue was detected by Arista and is known to be actively exploited, and that Hosted (including Dedicated) VCO was impacted and has already been patched. Arista rates it CVSS 3.1 9.9 and CVSS 4.0 9.4. Affected on-prem releases: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12; end-of-support versions were not assessed. Arista lists two IP addresses seen conducting the attacks (74.82.197.86 and 38.54.50.151) and advises blocking them and checking logs for them. VeloCloud Gateway, VeloCloud Edge and Arista EOS-based products are listed as not affected. This is a separate flaw from the actively exploited VCO bug CVE-2026-93952 that Arista disclosed in September (see this desk's card). BleepingComputer reported the advisory on 22 October. Source: Arista Security Advisory 0199 (22 Oct 2026); wire: BleepingComputer (22 Oct).

Product

Arista VeloCloud Orchestrator (VCO) On-Prem (formerly VeloCloud Orchestrator by Broadcom); Hosted/Dedicated VCO already patched by Arista

Versions

On-prem affected: 5.2.x before 5.2.3.18; 6.1.x before 6.1.3.10; 6.4.x before 6.4.2.12 (end-of-support versions not assessed). Fixed: 5.2.3.18+, 6.1.3.10+, 6.4.2.12+ (Arista SA-0199, as of 22 Oct). Hosted/Dedicated: patched by Arista.

CVSS

9.9 (CVSS 3.1, Arista) / 9.4 (CVSS 4.0)

Exploited in Australia?

unknown

Patch to

Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later in your train; if you are not on a supported train, contact Arista TAC. Until patched, Arista advises restricting the VCO web interface to trusted administrative networks, blocking and searching logs for 74.82.197.86 and 38.54.50.151, monitoring for unexpected outbound traffic from the VCO host, backdoor daemons and webshells, and reviewing recent administrator activity and VCO web access logs (unusual URL-like path components, encoded characters, references to local or internal services, high request rates). If compromise is suspected, preserve web, application, system and database logs and file-system timestamps before remediating.

Primary: Arista Security Advisory 0199 — VeloCloud Orchestrator CVE-2026-114625 (22 Oct 2026) · Vendor: Arista — Security Advisory 0199 · CVE: CVE-2026-114625, CVE-2026-93952 · BleepingComputer — Arista patches new VeloCloud Orchestrator zero-day exploited in attacks (22 Oct 2026)

vulnerabilities network cloud