Arista VeloCloud Orchestrator Zero-Day CVE-2026-114625: Patch On-Prem VCO and Check for Compromise

What happened

On 22 October 2026 Arista published Security Advisory 0199 for CVE-2026-114625, a SQL injection vulnerability (CWE-89) in VeloCloud Orchestrator (VCO) On-Prem, which the advisory lists as formerly VeloCloud Orchestrator by Broadcom. Arista says it detected the issue itself and that it is known to be actively exploited.

BleepingComputer describes VCO as a web-based management portal used to configure, monitor and manage VeloCloud SD-WANs and their edge devices. Arista scores the flaw 9.9 under CVSS v3.1 and 9.4 under CVSS v4.0.

According to the advisory, on an affected system any authenticated user can gain operator privileges and masquerade as a local “superuser operator” user. That includes access to functionality intended for internal use only, which is not meant to be remotely accessible. Successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.

Hosted VCO, including Dedicated versions, was also impacted and has already been patched. Customers running VCO on their own infrastructure need to act.

On 23 October 2026 CISA added the flaw to the KEV catalogue, citing evidence of active exploitation. The listing sets a due date of 26 October 2026 for US federal agencies and flags forensic triage as required. CISA lists the ransomware campaign use as unknown. Arista has not named a threat actor or said how many organisations are affected.

SecurityWeek reports this is the third exploited zero-day Arista has patched in VCO in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.

Who is affected

On-premises VeloCloud Orchestrator running:

• VCO 5.2.x before 5.2.3.18
• VCO 6.1.x before 6.1.3.10
• VCO 6.4.x before 6.4.2.12

Arista notes that end-of-support versions have not been assessed, so treat them as potentially affected and plan an upgrade. Arista lists VeloCloud Edge, VeloCloud Gateway and its EOS-based products as not affected.

Arista states that “VCO is exposed by default”. A successful attack requires network access to the VCO web interface and a valid authenticated session on the VCO portal. The minimum role is Enterprise Read Only, the lowest built-in tenant role, and Arista says “there is no configuration that can prevent the exposure”. That puts the focus on who holds portal accounts, including any read-only accounts held by third parties.

Why it matters

Arista says successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. An operator-level foothold on a management system is a position from which an attacker could see, and potentially change, configuration for the estate it controls.

Repeated exploitation of the same product is also a signal in itself. If you patched the earlier VCO flaws, do not assume the work is finished: check that the new fixed release is in place.

What to do now

1. Upgrade. Move on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. If your VCO is not on a supported release train, Arista says to contact its Technical Assistance Center (TAC) to discuss upgrade options.
2. Restrict access to the portal. Arista advises limiting the VCO web interface to trusted administrative networks. It should not be reachable from the open internet.
3. Block and search for known infrastructure. Arista lists 74.82.197.86 and 38.54.50.151 as observed conducting the attacks. Block them, and review logs to see whether they appear.
4. Review accounts. Audit VCO users, especially read-only, enterprise and partner accounts. Remove stale accounts, rotate credentials for shared or third-party logins, and enforce SSO/MFA where supported. This is our hardening advice rather than a step in the advisory.
5. Hunt before you remediate. Arista recommends reviewing VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, and high request rates, plus recent administrator activity for unexpected changes.
6. Preserve evidence if compromise is suspected. Arista advises preserving VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediation where operationally feasible. That keeps the record intact if you need to answer whether anyone changed configuration.
7. Add interim controls until you have patched. Arista also lists monitoring for unexpected outbound network activity from the VCO host, considering blocking outbound ports that normal operation does not need, and monitoring for backdoor daemons and webshells.
8. Check downstream. If you find signs of operator-level access, review configuration and policy changes made through VCO and any new or modified operator accounts.

What this means for testing scope

An advisory like this is a prompt to ask whether your last test would have caught the same class of weakness. Three questions are worth putting to your internal team or your testing provider.

• Are management planes in scope? Controllers and orchestrators are often left out of infrastructure tests because they are treated as vendor-managed or internal. An external and internal network test should at least confirm which networks can reach the management interface.
• Is the lowest role tested, not just admin? This flaw is an escalation from the least-privileged built-in role. Authenticated testing with only an administrator account would not exercise that boundary, so ask for each role you actually issue to be tested, ideally on a staging instance.
• If a provider runs your SD-WAN, what do they say? Ask which VCO version serves your environment, when it was upgraded, and whether the hosted fix applies to you.

How PoCForge can help

Our assessments look at SD-WAN and network management planes the way an attacker would: which interfaces are exposed, which low-privilege and third-party accounts exist, and how far a single credential reaches. If you run on-prem VCO and want an independent check of exposure and access controls after patching, get in touch.

Sources

• Arista Security Advisory 0199 (22 Oct 2026)
• CISA, “CISA Adds One Known Exploited Vulnerability to Catalog” (23 Oct 2026)
• CISA Known Exploited Vulnerabilities catalogue (version 2026.10.23)
• SecurityWeek, “Attackers Exploit Third Arista VCO Zero-Day in Four Months” (23 Oct 2026)
• The Hacker News, “CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud” (24 Oct 2026)
• CVE record CVE-2026-114625
• BleepingComputer, “Arista patches new VeloCloud Orchestrator zero-day exploited in attacks” (22 Oct 2026)

PoCForge publishes offensive-security research to explain attack paths and defensive controls. This article summarises public advisories and reporting only; it is not an exploit guide and does not describe a named client engagement.