By Hamza Faisal

Arista Networks has issued a stark warning to enterprise network administrators: a critical zero-day vulnerability in its VeloCloud Orchestrator is already being exploited in the wild, and the barrier to abuse is uncomfortably low.

The flaw, tracked as CVE-2026-114625 and disclosed in Arista Security Advisory 0199 on October 22, is a SQL injection vulnerability in on-premises deployments of the VeloCloud Orchestrator (VCO) — the web-based management hub that controls VeloCloud SD-WAN networks and their edge devices. It carries a CVSS 3.1 score of 9.9 out of 10, placing it in the most severe category.

A 9.9-rated flaw with an alarmingly low bar

What makes this zero-day particularly dangerous is who can exploit it. According to Arista, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" — a role with access to functionality meant for internal use only, and never intended to be remotely reachable. That includes accounts holding the Enterprise Read Only role, the lowest built-in role for customer users.

The attack is low complexity and requires no user interaction: all an attacker needs is network access to the orchestrator's web interface and a valid login. Successful exploitation can compromise the confidentiality, integrity, and availability of both the orchestrator and the data it manages — and may even affect the VCO host itself.

The third VeloCloud zero-day in three months

This is the third VCO flaw since late July that Arista has confirmed as actively exploited — but it is the first of the three to require a login. The July flaw (CVE-2026-16812) and the September flaw (CVE-2026-93952) needed no credentials at all.

Crucially, orchestrators patched against the July and September flaws are still vulnerable to this one, because those older releases predate the new fixes. Arista acquired the VeloCloud SD-WAN product line from Broadcom in a deal announced in July 2025; the products were previously known as VMware SD-WAN by VeloCloud.

What network admins should do now

On-premises operators must upgrade to VCO 5.2.3.18, 6.1.3.10, or 6.4.2.12, depending on their release train. Hosted and Dedicated VCO deployments were impacted too, but Arista says those have already been patched.

Until patches are applied, Arista advises administrators to block the IP addresses 74.82.197.86 and 38.54.50.151, which have been observed in ongoing attacks; restrict access to the VCO web interface to administrative networks; review recent administrator activity for unusual changes; and scan web access logs for suspicious request patterns such as unusual URL-like path components, encoded characters, and abnormal request rates.

By Hamza Faisal