Arista's VeloCloud Orchestrator Just Got Its Third Exploited Zero-Day in Four Months, and No Setting Stops It

Attackers have broken into Arista's VeloCloud Orchestrator again. On October 22, Arista shipped an emergency fix for CVE-2026-114625, a critical SQL injection in the on-premises version of the console companies use to run their branch networks, after spotting it being exploited in the wild.

It is the third exploited zero-day in the product in four months. And this time Arista says there is nothing an admin can switch off to stay safe.

From the lowest role to superuser

VeloCloud Orchestrator, or VCO, is the web portal administrators use to configure, monitor and manage VeloCloud SD-WANs and their edge devices. Whoever controls it controls how a company's offices connect.

The new flaw carries a CVSS score of 9.9. It is remotely exploitable, low complexity and needs no user interaction. An attacker only needs to reach the VCO web interface with a valid session holding the lowest built in tenant role.

"On an affected system, any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user," Arista wrote in its advisory. That includes "functionality that is intended for internal use only and which is not intended to be remotely accessible." Successful exploitation can compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.

Arista said the issue "was detected by Arista and is known to be actively exploited." VCO deployments are exposed by default, and "there is no configuration that can prevent the exposure."

Patch, then go looking

Every VCO release before 5.2.3.18, 6.1.3.10 and 6.4.2.12 is affected. Arista has already patched its hosted VCO, so the job falls to on-prem customers, who have to update. CISA has added the bug to its Known Exploited Vulnerabilities catalog.

Attacks have come from two IP addresses, 74.82.197.86 and 38.54.50.151, Arista said. Until the update is in, it advises limiting the VCO web interface to admin networks, reviewing recent admin activity and blocking outbound ports. Web access logs deserve a close read for unusual URL like path components, encoded characters, references to local or internal services and high request rates. Admins should also watch for backdoor daemons and webshells.

Where compromise is suspected, Arista wants customers to preserve VCO web access, backend application, system and database logs, plus file system timestamps, before fixing anything, and to contact Arista TAC.

A pattern, not a one off

The October bug follows CVE-2026-16812 in July and CVE-2026-93952 in September, the CVSS 10 VeloCloud Orchestrator zero-day Arista patched last month. Counting a May flaw in its EOS software, CVE-2026-7473, Arista has now patched four exploited zero-days this year.

Arista is a Fortune 500 company with over 10,000 customers. The console that runs those customers' branch networks keeps turning up new holes, and for now the only defense is patching it every time.

Some offers on this page may be paid placements or contain affiliate links.