Third Exploited VeloCloud Orchestrator Zero-Day Since July: Even a Read-Only Login Can Become a Superuser
Arista has patched another actively exploited flaw in on-premises VeloCloud Orchestrator, the console that runs VeloCloud SD-WAN networks. This one needs a login, but only the lowest customer role. Here is the spec sheet and a triage checklist for anyone whose branch network depends on it.
If your branch offices connect through VeloCloud SD-WAN, the management console behind that network has a new problem. Arista Networks released fixes on Thursday for a SQL injection flaw in on-premises VeloCloud Orchestrator (VCO) that it found itself and says is already being exploited. It is the third exploited VCO zero-day since July.
This post is based on SecurityWeek’s report, with additional detail from BleepingComputer and The Hacker News.
The spec sheet
- Flaw: CVE-2026-114625, a SQL injection in the VCO web application
- Severity: critical, CVSS 9.9
- Status: exploited in attacks, per Arista’s advisory
- What an attacker needs: network access to the VCO web interface and a working login. The lowest built-in customer role, Enterprise Read Only, is enough.
- What they get: the ability to act as a local “superuser operator,” including internal-only functions never meant to be reachable remotely. Arista says it could also affect the VCO host and expose, change or disrupt the orchestrator and the data it manages.
- Affected: on-premises VCO releases before 5.2.3.18, 6.1.3.10 and 6.4.2.12
- Not affected: VeloCloud Gateway and VeloCloud Edge. The 7.0 release train is not on the list, and Arista says unlisted releases are not vulnerable.
- Hosted VCO: already patched by Arista
- Workaround: none. Arista says VCO is exposed by default and no configuration prevents the exposure.
- Attack sources seen so far: 74.82.197.86 and 38.54.50.151
Why the pattern matters more than the single bug
In July it was CVE-2026-16812. In September it was CVE-2026-93952. Now it is CVE-2026-114625. The Hacker News notes that the two earlier flaws did not require a login, which makes this the first of the three that does. That sounds reassuring until you remember how VCO is organized: operators create partner and customer accounts, and each partner can manage a group of customers. Every one of those customer logins, even a read-only one, is now a potential way in.
There is also a catch for anyone who patched carefully over the summer. Releases that fixed the July and September flaws are older than today’s fixed versions, so they are still vulnerable. And as of October 22, the September flaw had no listed fix on the 6.1 train. Neither advisory says whether 6.1.3.10 also closes it.
For the earlier two flaws, Arista warned that a compromised orchestrator could hand attackers access to the Edge devices it manages. For this one, the advisory does not say whether that risk applies, or whether upgrading removes access an attacker already has.
Triage checklist for on-premises VCO
- Confirm your version. If it is below 5.2.3.18, 6.1.3.10 or 6.4.2.12 on its train, plan the upgrade now.
- Preserve evidence first if anything looks wrong. Arista asks operators who suspect compromise to save VCO web access logs, backend application logs, system logs, database logs and file-system timestamps before fixing, where feasible.
- Block and search for the two attacker IP addresses listed above.
- Read the web logs for unusual URL-like path components, encoded characters, references to local or internal services, and high request rates.
- Shrink who can reach the console. Until you upgrade, limit the VCO interface to administrative networks.
- Review recent admin activity and the list of customer and partner accounts, especially low-privilege ones nobody owns anymore.
- Watch the host’s outbound traffic, block outbound ports normal operation does not need, and look for backdoor daemons and webshells.
- If in doubt, call Arista’s Technical Assistance Center, which the advisory points customers to.
Still unknown
Arista has not said when exploitation began, how many orchestrators were hit, or who is behind it. VeloCloud changed hands recently, too: Arista announced it was buying the product line, formerly VMware SD-WAN by VeloCloud, from Broadcom in July 2025.
What this means for your company
Most small and mid-sized businesses do not run their own SD-WAN orchestrator, but many rely on one run by a carrier or managed provider. Ask whoever manages your branch networking which product and version they use, whether it is hosted or on-premises, and when it will be on a fixed release. The broader lesson applies to every management console you own, whether for firewalls, Wi-Fi, backups or remote access: keep it off the open internet, prune accounts that nobody uses, and make sure its logs are kept somewhere an attacker cannot erase them. Three exploited flaws in four months on one console is a reminder that “read-only” is not the same as “harmless.”
Need help locking down the management consoles that run your network and confirming they are patched? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
