VeloCloud CVE-2026-114625: A Read-Only Login Becomes Superuser

Arista VeloCloud Orchestrator has its third exploited zero-day since July. This one needs a login, but only the weakest one the product offers: a read-only tenant account is enough to become a superuser operator. CISA has given federal agencies until Monday. Teams that patched in September are still exposed.

DataWater Threat Intelligence Desk | Published October 24, 2026 | 8-minute read

Threat level: Critical (exploited)

What: CVE-2026-114625, a SQL injection flaw (CWE-89) in on-premises Arista VeloCloud Orchestrator (VCO) that lets any authenticated user take operator privileges. CVSS v3.1 9.9, CVSS v4.0 9.4. Arista Security Advisory 0199.

Status: Arista says it found the flaw itself and that it is being actively exploited. CISA added it to the Known Exploited Vulnerabilities catalog on Friday, October 23, 2026.

Deadline: Monday, October 26, 2026 for federal civilian agencies, as reported by Security Affairs and a second outlet. That leaves one working day.

Fix: Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. Hosted and Dedicated VCO are already patched by Arista. Then hunt for signs of compromise.

Executive Summary

The VeloCloud Orchestrator is the control plane for every SD-WAN edge it manages. For the third time in three months, attackers have found a way in.

On October 22, Arista published Security Advisory 0199 for CVE-2026-114625. The flaw sits in on-premises VeloCloud Orchestrator, the management system that pushes configuration and policy to VeloCloud Edge devices across branch networks. Arista classifies it as SQL injection and says an authenticated user can use it to act as a built-in “superuser operator,” reaching functions that were only meant to be used internally. Arista says it detected the issue and that it is known to be exploited. CISA put it on the KEV catalog the next day.

Unlike the July flaw (CVE-2026-16812) and the September flaw (CVE-2026-93952), this one needs a valid session. That sounds reassuring until you read the required role: Enterprise Read Only, the lowest built-in tenant role. Partners, managed service customers and auditors are routinely given exactly that kind of account. Arista also says VCO is exposed by default and that no configuration setting prevents the exposure.

The bottom line: upgrade every on-prem orchestrator to a fixed build before Monday, restrict its web interface to admin networks, and audit who holds low-privilege accounts. Any sign of the attacker IPs or unexplained operator activity turns this from a patch into an incident.

Why This Matters to CISOs and Security Leaders

One orchestrator controls many sites. Arista’s July guidance warned that a compromised orchestrator could give attackers access to the VeloCloud Edge devices it manages, according to BleepingComputer’s report on that advisory. Operator-level access on the orchestrator is not one server lost; it can be every branch’s routing and security policy.

“Authenticated” does not mean “trusted.” The lowest tenant role is the one most likely to be shared with third parties, left behind after a project, or protected with a weak password. If any one of those accounts can be phished, bought or guessed, CVE-2026-114625 turns it into operator access.

Patch fatigue is the attacker’s friend. Teams that ran an emergency upgrade in late July and again in late September are now being asked to do it a third time. The same teams are working through Cisco’s SD-WAN Manager zero-day and a stream of firewall and VPN bugs. The pattern across these SD-WAN control planes is consistent: management software is the target.

The Timeline

The lowest role in the product is now the shortest path to the highest one.

Vulnerability & Exploit Analysis

What CVE-2026-114625 is

Arista tags CVE-2026-114625 as SQL injection (CWE-89). Its description focuses on the result rather than the mechanics: an attacker with network access to the VCO web interface and a valid session can impersonate a local “superuser operator” account and reach internal-only functionality, with high impact on the confidentiality, integrity and availability of the orchestrator and the data it manages. The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) reflects a network attack that needs low privileges, no user interaction, and crosses a security boundary. Arista has not published exploit details, and none of the sources DataWater reviewed mention a public proof of concept.

Affected and fixed versions

Not affected: VeloCloud Gateway, VeloCloud Edge, Arista EOS and Arista’s other product lines, per the advisory.

Interim protections

Arista says no setting removes the exposure, so its interim advice is defense in depth: limit the VCO web interface to trusted admin networks, block the two attacker IPs, restrict outbound ports the VCO host does not need, and watch for backdoor daemons, webshells and unexpected admin changes. None of this replaces the upgrade.

Threat Intelligence Breakdown

Attribution: Unknown. Arista has not named an actor, the number of victims, or what attackers did after gaining access. Reporting cited by one outlet says The Hacker News and SecurityWeek describe this as the third exploited VCO zero-day in about four months, and one vendor analysis counts it as Arista’s fourth exploited zero-day of 2026. That analysis also suggests a sustained campaign against SD-WAN management systems, which Arista has not confirmed.

Exposure: One researcher counted 520 internet-visible VCO interfaces in a ZoomEye search on October 22 (single-source). That is a count of visible portals, not confirmed vulnerable systems.

Indicators of compromise (Arista Advisory 0199, defanged):

How to read these: two IPs are a thin indicator set and will age quickly. The September advisory for CVE-2026-93952 listed specific implant files; this one does not. Absence of the IPs does not prove a clean orchestrator.

Enterprise Impact: What’s Actually at Risk

Network policy across every site: The orchestrator holds the configuration for managed edges. Operator access could let an attacker change routing, security policy or device settings across branches.

Tenant data and credentials: In multi-tenant deployments, including managed service providers, an operator-level account sees across tenants. Treat all tenant data and any stored credentials or keys as exposed on a compromised instance.

Third-party access risk: Any read-only account given to a partner, customer or contractor is now a potential path to full control. That makes account hygiene a remediation step, not housekeeping.

Audit and compliance: This is the third KEV-listed VCO flaw since July, each with a three-day window. Auditors and insurers will ask how quickly you upgraded each time and what your compromise checks found.

What Security Leaders Should Do Next

Today

1. Inventory every on-prem VCO, including lab and DR instances, and record the exact build.
2. Preserve evidence first: web access, application, system and database logs, plus file-system timestamps, as Arista advises.
3. Restrict the VCO web interface to trusted admin networks and block 74.82.197[.]86 and 38.54.50[.]151.
4. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. On 7.0 or an unsupported train, open a TAC case now.

Within 48 hours

1. Hunt the logs for the two IPs and for encoded or unusual requests and high request rates.
2. Audit accounts: list every Enterprise Read Only, partner, customer and admin account; disable stale ones and reset credentials for the rest.
3. Review operator and admin changes since at least October 1, and check edges for configuration you did not push.
4. If anything matches, run an incident: isolate, contact Arista TAC, rebuild or restore from known-good, and rotate every credential and key the orchestrator held.

Long-term

1. Track SD-WAN fixes by build number, not CVE, so a newer advisory reopens old tickets automatically.
2. Take management planes off the internet and put them behind a VPN or zero-trust access layer with MFA.
3. Weigh Arista’s hosted VCO. In all three 2026 VCO zero-days, Arista patched hosted instances before customers had to act.

Winners and Losers

Final Executive Takeaway

The VeloCloud fix you installed last month is not the fix you need now.

CVE-2026-114625 turns the weakest login on the orchestrator into its strongest role, and attackers are already using it. CISA’s window closes Monday.

Upgrade the orchestrator. Lock down its portal. Audit every low-privilege account as if it were an admin, because for now it effectively is.

Frequently Asked Questions

Sources

Primary sources: Arista Security Advisory 0199 (October 22, 2026); Arista Security Advisory 0183 (CVE-2026-93952); CISA alert, October 23, 2026. Additional reporting reviewed: Security Affairs (deadline), SOCRadar, WebProNews, Safeguard, IT BOLTWISE, Aviatrix, a DEV Community analysis (exposure count, single-source) and BleepingComputer’s July coverage of CVE-2026-16812. Reflects public reporting as of October 24, 2026.