Arista Confirms Attacks on VeloCloud Orchestrator Vulnerability

Arista Networks issued a security notice on October 22 stating that CVE-2026-114625, an SQL injection flaw in the VeloCloud Orchestrator web portal, is currently being exploited by attackers. The vulnerability received a score of 9.9 out of 10 on the CVSS 3.1 scale, according to the notice shared by The Hacker News and BleepingComputer. This is the third flaw exploited in Arista’s SD-WAN orchestrator in about three months.

The vector requires login, which is where the issue lies. Just a low-profile account of the product, Enterprise Read Only, is enough for the attacker to elevate their own privileges to that of an operator and access functions that should be internal. In other words, a credential meant for audits, NOC analysts, and managed service provider clients transforms into administrative access.

What Needs to be Updated

Arista states that the Hosted and Dedicated instances operated by them have already been patched. Clients with on-premises orchestrators need to install versions 5.2.3.18, 6.1.3.10, or 6.4.2.12. One less obvious point: environments that applied July and September patches remain vulnerable, as these builds are below the new versions, according to analyses published after the notice.

The company did not disclose how many clients were affected nor who is behind the exploitation. By the time of the notice’s publication, the flaw was not listed in CISA’s known exploited vulnerabilities catalog (KEV).

A Pattern, Not an Accident

In July, CVE-2026-16812, an unauthenticated command injection scoring 10.0, was added to the CISA KEV catalog on July 27 following evidence of active exploitation. In September, CVE-2026-93952, also scoring 10.0, affected orchestrators configured with certificate-based authentication between edge devices and the VCO. Three sequentially exploited flaws in the same component suggest that a group is systematically studying the product, although neither Arista nor CISA have attributed the attacks to a specific actor or stated if the three campaigns are from the same origin.

VeloCloud is the SD-WAN line acquired by Arista from Broadcom in 2025, inherited from VMware's portfolio. For Arista, whose core business is datacenter switches, the recent history weighs in discussions with corporate clients evaluating consolidating campus and WAN networks under one vendor.

Who is Most Exposed

The orchestrator is the point that configures and monitors all edge devices in an SD-WAN network. Compromising the VCO means, potentially, gaining access to the routing policy of hundreds of branches at once. In telecommunications and managed service providers running a single on-premises orchestrator for multiple clients, the risk multiplies: the read-only account provided to each client to monitor their own contract is exactly the profile required by the flaw.

In the United States, if CISA includes CVE-2026-114625 in the KEV catalog, as it did with the previous two, federal agencies are mandated to patch it within the timeframe set by directive BOD 22-01, and the private market typically uses the list as a priority guideline.

In the European Union, entities covered by the NIS2 directive, including managed service providers and operators, have 24 hours to submit an initial alert to the national authority upon becoming aware of a significant incident. A compromised orchestrator serving multiple clients is unlikely to fall below that threshold.

In Brazil, Resolution CD/ANPD No. 15 of 2024 gives the controller three business days to notify the authority and stakeholders of an incident with relevant risk or damage. In retail networks and banks with hundreds of branches connected via SD-WAN, access to the orchestrator is likely to involve traffic and configuration data before involving personal data, complicating the assessment of "relevant risk" and making it no less urgent.

For the CISO, the practical question goes beyond the patch. Three exploited vulnerabilities in a quarter within a management plan exposed to the internet call for the orchestrator interface to be moved from the public network behind a VPN or a restricted list of addresses, and for read-only accounts to again be treated as sensitive credentials. The patch resolves CVE-2026-114625. The architecture will determine whether there will be a fourth.