Arista VeloCloud Orchestrator Flaw Is Being Exploited: What Network Teams Should Know

CYBER FRIDAYS · OCTOBER 24, 2026

Arista has confirmed active exploitation of a critical vulnerability in VeloCloud Orchestrator. The issue can let an authenticated account—including a low-privilege user—gain powerful operator access.

What happened?

Arista published Security Advisory 0199 on October 22, 2026. The flaw, CVE-2026-114625, affects certain on-premises VeloCloud Orchestrator (VCO) releases. The company says the vulnerability is actively exploited and rates it 9.9 under CVSS v3.1.

Why is VeloCloud Orchestrator important?

VeloCloud Orchestrator is a management platform for software-defined wide area networking (SD-WAN). It helps administrators manage WAN connectivity, policies, and the edge infrastructure linking branches and remote locations. A compromised orchestrator is a serious concern because of the scope of systems and configurations it can manage.

How does the flaw work?

Arista describes a SQL injection issue that allows an authenticated user to reach privileged internal functionality and impersonate a local superuser operator. This is not described as a no-login attack: the attacker needs an authenticated account, but even a read-only tenant account may be sufficient. The risk is privilege escalation within a sensitive network-management system.

Affected and fixed versions

For VCO 5.2.x, upgrade to 5.2.3.18 or later; for 6.1.x, upgrade to 6.1.3.10 or later; and for 6.4.x, upgrade to 6.4.2.12 or later. Arista says affected hosted and dedicated deployments have already been patched. Unsupported versions should be reviewed directly with the vendor.

What should administrators do?

1. Inventory VCO deployments and identify the exact software version and hosting model.
2. Apply the vendor’s fixed release for affected on-premises systems.
3. Review who has VCO accounts, including read-only users and third-party access.
4. Restrict access to the management interface and review audit trails for unexpected operator-level activity.
5. If suspicious activity is found, investigate potential compromise rather than assuming a patch alone resolves it.

Sources and further reading

• Arista Security Advisory 0199
• Canadian Centre for Cyber Security — AV26-1080
• CVE Record — CVE-2026-114625

Cyber Fridays — original IT and cybersecurity commentary by John Brown. Check the vendor’s latest advisory before making production changes.