CVE-2026-114625 (CVSS 9.9): Arista VeloCloud Orchestrator Zero-Day Exploited — Third SD-WAN Attack in 2026

If you manage an on-premises Arista VeloCloud Orchestrator, stop reading and open your patch management console right now. On October 22, 2026, Arista published Security Advisory SA 0199 disclosing CVE-2026-114625 — a SQL injection zero-day actively being exploited in the wild. The kicker: any user with a read-only account can weaponise it to seize superuser-level control of your entire SD-WAN fabric. This is the third VeloCloud Orchestrator zero-day exploited in 2026 alone, and it carries a CVSS 3.1 score of 9.9.

For Indian enterprises running distributed branch networks over VeloCloud — a common choice in BFSI, retail, and healthcare sectors — this is a direct threat to network sovereignty. Your SD-WAN control plane, the single pane of glass that governs every branch, every policy, every route, is the target.

What Is Arista VeloCloud Orchestrator, and Why Does It Matter?

VeloCloud, acquired by VMware and later incorporated into Arista’s SD-WAN portfolio, is one of the most widely deployed SD-WAN platforms globally. The VeloCloud Orchestrator (VCO) is the centralised management and policy plane: it configures edges (branch routers), controls application-aware routing, enforces security segmentation, and provides visibility across the entire wide-area network.

In enterprise deployments, VCO is the nerve centre. A compromise of VCO is not a single-branch problem — it is a full network compromise. An attacker with superuser operator access can modify routing policies, redirect traffic, disable security controls, access encrypted management tunnels, and position themselves for lateral movement into any connected branch or data centre segment.

For Indian enterprises that have deployed VeloCloud for their branch and retail networks — often the same networks carrying payment transactions, customer data, and operational technology — the blast radius of this vulnerability is severe.

Technical Breakdown: CVE-2026-114625

CVE-2026-114625 is a SQL injection vulnerability (CWE-89) in the on-premises VeloCloud Orchestrator web application. Its severity scores — CVSS 3.1: 9.9, CVSS 4.0: 9.4 — reflect how easily it can be reached and how damaging exploitation is.

The critical design flaw is in the access requirement. Arista’s advisory confirms that any authenticated VCO portal user, including an account with the lowest built-in tenant role (Enterprise Read Only), can trigger the vulnerability. In most enterprise VCO deployments, read-only accounts are distributed liberally — to NOC engineers, junior analysts, vendor support teams, and third-party consultants. Every one of those accounts is now a potential attack vector.

Upon successful exploitation, the attacker is able to masquerade as a local superuser operator, bypassing all tenant isolation and gaining access to internal-only management functions. From that position, the attacker can:

• Read, modify, or delete SD-WAN policies across all tenants and edges
• Access credentials and cryptographic material stored in the orchestrator
• Pivot to connected branch networks via the management plane
• Establish persistence through backdoored configurations or new admin accounts

Arista states the product is exposed by design in its default configuration, and no configuration change alone is sufficient to prevent exploitation — only patching or strict network-layer isolation of the VCO web interface mitigates the risk.

Attribute	Detail
CVE ID	CVE-2026-114625
Vulnerability Type	SQL Injection (CWE-89)
CVSS 3.1 Score	9.9 (Critical)
CVSS 4.0 Score	9.4 (Critical)
Access Required	Authenticated (any role, incl. Enterprise Read Only)
Impact	Superuser operator privilege escalation, full SD-WAN management control
Affected Versions	VCO 5.2.x < 5.2.3.18, 6.1.x < 6.1.3.10, 6.4.x < 6.4.2.12
Fixed Versions	5.2.3.18, 6.1.3.10, 6.4.2.12
Not Affected	VeloCloud Gateway, VeloCloud Edge, Arista EOS; cloud-hosted VCO already patched
Disclosed	October 22, 2026 (Arista SA 0199)

A Disturbing Pattern: Three VeloCloud Zero-Days in One Year

CVE-2026-114625 is not an isolated event — it is the culmination of an alarming pattern of exploitation targeting VeloCloud Orchestrator in 2026:

• July 2026 — CVE-2026-16812 (CVSS 10.0): An unauthenticated OS command injection in on-premises VCO. Maximum severity. Arista discovered the vulnerability through external reporting and confirmed active exploitation immediately. CISA added it to the KEV catalog on July 27, 2026, with federal agencies given three days to remediate.
• September 2026 — CVE-2026-93952: A second VCO zero-day, involving improper input validation and active exploitation targeting certificate-based authentication pathways in on-premises deployments.
• October 22, 2026 — CVE-2026-114625 (CVSS 9.9): The SQL injection zero-day. Active exploitation confirmed at the time of disclosure.

Three actively-exploited zero-days in one product in under four months is a red flag that warrants a strategic reassessment — not just a patch. Threat actors have clearly identified VeloCloud Orchestrator as a high-value target. The reasons are obvious: compromise one VCO instance and you own the SD-WAN of every branch it manages.

SecurityWeek’s reporting on this pattern reinforces what security architects have been warning for years: management planes for network infrastructure are crown jewels, and their attack surface has been systematically underestimated.

Active Exploitation: What We Know

Arista’s disclosure confirms active exploitation at the time of publication. Two attacker-controlled IP addresses have been identified in exploitation attempts: 74.82.197[.]86 and 38.54.50[.]151. Block these at your perimeter immediately and search your VCO access logs retroactively.

Critically, Arista’s advisory does not specify what attackers did after gaining access. The post-exploitation footprint is unknown publicly. That ambiguity is itself a threat intelligence gap — organisations that have already been compromised may not know it yet. Arista also does not confirm whether patching removes access an attacker has already established, which means patching alone may not be sufficient for potentially compromised environments.

The three-zero-day pattern, combined with the relatively low entry bar (any authenticated account), suggests a sophisticated, persistent threat actor — or multiple groups — who have made SD-WAN management infrastructure a priority target in 2026. This aligns with broader intelligence reports documenting nation-state and financially motivated actors targeting network infrastructure control planes as a precursor to large-scale espionage or ransomware campaigns.

India-specific context: BleepingComputer’s coverage notes that cloud-hosted and dedicated orchestrators were patched by Arista directly. However, India has a large installed base of on-premises VCO deployments driven by data localisation requirements and private cloud preferences. These on-premises instances are the ones at risk and must be patched by the customer.

What You Should Do Right Now

Here is the prioritised response sequence for VeloCloud Orchestrator operators, drawn from Arista’s advisory and sound incident response practice:

1. Identify your VCO version immediately. Log into your orchestrator and check the software version. If you are running VCO 5.2.x before 5.2.3.18, VCO 6.1.x before 6.1.3.10, or VCO 6.4.x before 6.4.2.12, you are vulnerable. Versions on the 7.0 train are not listed as affected.

2. Patch without delay. Update to 5.2.3.18, 6.1.3.10, or 6.4.2.12 depending on your release track. Consult Arista’s release notes and your support contract for the upgrade path. If you have a maintenance window constraint, implement network isolation controls immediately (see step 4) while you schedule the patch.

3. Audit user accounts — especially read-only accounts. Enumerate every account with VCO portal access, including vendor accounts, NOC observers, and consultant logins. Temporarily revoke or suspend accounts that are not immediately necessary. Rotate credentials for all remaining accounts after patching.

4. Restrict VCO web access at the network layer. The VCO management interface should only be reachable from dedicated admin workstations and jump hosts on an out-of-band management network. If it is currently reachable from general corporate or production subnets, fix that immediately — this is a zero-trust network segmentation failure that applies regardless of this CVE.

5. Block the known attacker IPs at your perimeter. Add 74.82.197[.]86 and 38.54.50[.]151 to your firewall and WAF blocklists immediately. Conduct a retroactive log review for any connections from these addresses to your VCO.

6. Review VCO audit logs for anomalies. Look for unexpected configuration changes, new admin account creation, policy modifications, or edge device reconfigurations — especially between July and October 2026. The three-CVE exploitation window means your orchestrator may have been probed or compromised before this latest disclosure.

7. Treat your environment as potentially compromised until proven otherwise. If you find suspicious activity, engage your incident response team and consider a full orchestrator rebuild from a known-clean backup rather than patching in place.

From a SD-WAN architecture perspective, this incident also reinforces a design principle that is too often deprioritised: the management plane must be architecturally isolated from the data plane and from the corporate network. If your VCO is accessible from any workstation with an internet connection, you are not running a secure SD-WAN — you are running a flat network with SD-WAN features bolted on.

FAQ

Are cloud-hosted VeloCloud Orchestrator instances affected by CVE-2026-114625?

No. Arista has already patched cloud-hosted and dedicated VCO instances. Only on-premises VCO deployments running versions before 5.2.3.18, 6.1.3.10, or 6.4.2.12 are affected. If you are unsure whether your deployment is on-prem or cloud-hosted, contact your Arista account team or check your service agreement.

Does this CVE affect VeloCloud Edges or Gateways at branch sites?

No. The vulnerability is specifically in the VeloCloud Orchestrator web application. VeloCloud Edge appliances at branch sites and VeloCloud Gateways in carrier networks are not affected. That said, if an attacker gains superuser operator access to VCO, they can potentially reconfigure edges and gateways — making VCO compromise indirectly devastating for the entire SD-WAN fabric.

Is a read-only account genuinely enough to exploit this?

Yes, according to Arista’s own advisory. The Enterprise Read Only role — the lowest built-in tenant role in VCO — is sufficient to trigger the SQL injection and escalate to superuser operator access. This dramatically expands the attack surface, since read-only accounts are routinely shared with NOC engineers, junior staff, external auditors, and vendor support teams.

If I can’t patch immediately, what is the best interim control?

Strictly limit network access to the VCO web interface. Place VCO behind a jump host or VPN that requires multi-factor authentication, and restrict access to a small, named group of administrators. Revoke or suspend all vendor and third-party accounts until after patching. Additionally, block the two known attacker IPs at your perimeter firewall and enable enhanced logging on the VCO interface. These are stopgap measures — patching remains the only true fix.

---

The bottom line: CVE-2026-114625 is a near-maximum-severity, actively-exploited zero-day in the management plane of one of the world’s most widely deployed SD-WAN platforms. Three such flaws in four months is not bad luck — it is a targeted campaign. If you run on-premises VeloCloud Orchestrator, patch today, not this week.

Arista’s security advisory and detailed technical guidance are available via the Arista Security Advisories page (SA 0199). Additional context is available from SecurityOnline, SecurityWeek, and the CISA KEV catalog.