VeloCloud Orchestrator Vulnerability: A Read-Only Login Is Enough, and Attackers Are Using It

A new VeloCloud Orchestrator vulnerability is being used in attacks right now, and the only thing an attacker needs is the lowest level of login. Arista published the details on 22 October 2026. The flaw, tracked as CVE-2026-114625, scores 9.9 out of 10 and sits in the central console that runs a company’s SD-WAN.

What the VeloCloud Orchestrator vulnerability allows

VeloCloud Orchestrator, or VCO, is the management system for VeloCloud SD-WAN. It holds the policy, topology and device inventory for every branch office a company connects. Whoever controls it controls the network.

The bug is an SQL injection (CWE-89), according to Arista’s Security Advisory 0199. Any logged-in user can use it to gain operator privileges. They can then pose as a local “superuser operator” account. Arista says a remote attacker may reach privileged internal functions and affect the VCO host itself.

The lowest built-in customer role, Enterprise Read Only, is enough to trigger it. Arista rates the flaw 9.9 under CVSS 3.1 and 9.4 under CVSS 4.0. Attackers need network access to the web interface and a valid session. VCO is exposed by default, Arista notes, and no setting prevents that.

The advisory states the issue “is known to be actively exploited”. Arista detected the attacks itself. It has not said when they began, which orchestrators were hit or what the attackers did afterwards.

Which versions are affected

Only on-premises deployments need action. Arista says its Hosted and Dedicated orchestrators were already patched. Gateways and Edge devices are not affected by this particular bug.

• 5.2 releases before 5.2.3.18
• 6.1 releases before 6.1.3.10
• 6.4 releases before 6.4.2.12

The 7.0 train is not on the list, and Arista says unlisted releases are not vulnerable. It has not checked end-of-support versions, though. If you run one, ask Arista’s support team. Do not assume you are safe.

A third exploited flaw in three months

VCO has been here before. The Hacker News reports that it is the third VCO flaw Arista has flagged as exploited since late July. The July bug is CVE-2026-16812. In September came CVE-2026-93952, which Arista rates 10.0 in Security Advisory 0183.

That September flaw needed no VCO credentials at all, only network access to the web interface. The new one needs a login, but the barrier is low. Read-only access leaks easily. Think of reused passwords, a phished contractor or a stale account nobody removed.

There is also a patching wrinkle. The September advisory lists fixes for the 5.2 and 6.4 trains but none yet for 6.1. The Hacker News says it is unclear whether 6.1.3.10 closes that earlier hole as well. Check the current advisories for your train. Do not rely on the version you last patched to.

What to do this week

Patching comes first. Move to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. Then work through the steps Arista recommends while you do:

• Limit access to the VCO web interface to trusted administrator networks.
• Block the two addresses Arista saw in the attacks: 74.82.197.86 and 38.54.50.151.
• Watch for unexpected outbound traffic from the VCO host, and block outbound ports it does not need.
• Look for backdoor daemons and web shells, and review recent administrator activity.
• If you suspect a compromise, preserve web access, application, system and database logs, plus file-system timestamps, before you remediate.

One caveat: Arista’s advisory does not say whether upgrading removes access an attacker already holds. Patching closes the door. It does not tell you if someone is already inside. If the orchestrator faced the internet before you patched, treat it as a possible incident until the logs say otherwise.

What this says about management planes

Network management consoles are a favourite target because one foothold reaches everything. Yet they are often the least tested part of the estate. They sit behind a vendor login page, so teams assume the vendor has handled security. This VeloCloud Orchestrator vulnerability shows the risk of that assumption.

Three exploited flaws in one product line say otherwise. A regular penetration test that includes your management interfaces will show who can reach them, what a low-privilege account can do and whether segmentation holds. It will also test your role model. Many firms hand out read-only accounts freely because they seem harmless. This bug shows why that needs checking.

Basic hygiene helps too. Schemes like Cyber Essentials push firms to patch quickly and limit who can reach admin services. Both habits would shrink the window here. If you cannot say today who can reach your orchestrator’s web interface, that is the first thing to find out.