Arista's October 22 VeloCloud flaw turns read-only into operator

Arista disclosed a zero-day SQL injection in VeloCloud Orchestrator on October 22 that lets anyone with an Enterprise Read Only account, the lowest built-in customer role, escalate to operator, the top level of control over the system. It is tracked as CVE-2026-114625, rated 9.9 on CVSS, and it is already being exploited.

VCO is the central management plane for VeloCloud SD-WAN, the product line Arista bought from Broadcom in a deal announced in July 2025 and known before that as VMware SD-WAN by VeloCloud. Operators sit above everything in VCO: they create the customer and partner accounts, and each partner manages a group of customers. The flaw collapses that hierarchy. An attacker who can reach the web interface and log in with any valid credential acts as a local superuser with full access. Arista says the bug may also let an attacker reach the VCO host itself, exposing, modifying, or disrupting the orchestrator and the data it manages.

The entry bar is low for two reasons. VCO is exposed by default and no VCO setting prevents that exposure. And the credential it needs is the one you hand to someone who is only supposed to read: Enterprise Read Only. If you have ever given a customer or an auditor a look-only login to your orchestrator, that account is now a path to full control.

This is the third VCO flaw since late July that Arista has reported as exploited, after CVE-2026-16812 in July and CVE-2026-93952 in September. It is the first of the three to require a login at all; the other two needed none.

The patching trap

The patch situation is where this gets awkward. On-premises orchestrators are fixed in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12. Hosted and Dedicated orchestrators are already patched. The trap is that the releases which fixed July’s and September’s flaws are older than these, so an orchestrator you patched for the last two incidents is still vulnerable to this one. VeloCloud Gateway and Edge are not affected, and the 7.0 train is not on the list. Arista says any release not on the list is not vulnerable, and it has not checked releases past end of support; if you are on an unsupported train, TAC is the only route to an upgrade path.

If you run the 6.1 train, read the matrix carefully. As of October 22, September’s flaw (CVE-2026-93952) is fixed only in the 5.2 and 6.4 trains. On 6.1 it affects releases up to 6.1.3.7 with no fixed release listed, and neither advisory says whether 6.1.3.10, the fix for this new flaw, also closes September’s. Upgrading 6.1 to stop this injection may leave the September hole open.

If you cannot upgrade yet

Until you can install the fix, Arista’s interim steps are the usual containment: restrict the VCO web interface to trusted administrative networks, block outbound ports normal operation does not need, and watch for unexpected outbound traffic from the VCO host, for backdoor daemons and webshells, and for unexpected changes in recent administrator activity.

For detection, two attacking IPs have been observed: 74.82.197.86 and 38.54.50.151. Block them and grep your logs for both. Beyond the IPs, check VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates, the signatures you would expect from injection probing. If you find something, preserve evidence before you remediate: the web access, backend application, system and database logs, plus the relevant filesystem timestamps.

The advisory is thin on the incident itself. It does not say when the attacks began, which orchestrators were hit, or what the attackers did once in. For the July and September flaws, Arista warned that a compromised orchestrator could also hand attackers access to the VeloCloud Edge devices it manages. For this flaw the advisory does not say whether that downstream risk applies, or whether upgrading removes access an attacker has already gained. Until Arista says otherwise, a confirmed compromise is safest treated as reaching your edge fleet.