VeloCloud Orchestrator SQLi Zero-Day CVE-2026-114625

What to do

1. Inventory every on-prem VCO and its exact release; anything below 5.2.3.18, 6.1.3.10 or 6.4.2.12 is exposed to an exploited bug.
2. Upgrade to 5.2.3.18 or 6.4.2.12 or later, which also carry the July and September fixes; on 6.1 or an unsupported train, upgrade and ask Arista TAC about CVE-2026-93952.
3. Restrict the VCO web interface to trusted administrative networks and block outbound ports the VCO host does not need.
4. Block 74.82.197.86 and 38.54.50.151 and search your logs for both.
5. Review recent administrator activity and remove tenant users who no longer need access.
6. If you suspect compromise, preserve web, application, system and database logs and file timestamps before upgrading, then contact Arista TAC.

How to check if you are affected or compromised

• Search VCO web access logs for requests from 74.82.197.86 and 38.54.50.151.
• Look for requests with URL-like path components, encoded characters, references to local or internal services, or unusually high request rates from one session.
• Check for operator-level actions or configuration changes you did not make, especially ones tied to low-privilege tenant sessions.
• Watch for unexpected outbound connections from the VCO host, new daemons and webshells.

What happened#

On October 22, 2026, Arista published Security Advisory 0199 for CVE-2026-114625, an SQL injection (CWE-89) in VeloCloud Orchestrator (VCO) On-Prem. Arista found the bug itself and says it is known to be actively exploited. It scores the flaw CVSS 3.1 9.9 and CVSS 4.0 9.4.

The flaw is a privilege escalation. Any authenticated user can gain operator privileges and pose as a local "superuser operator." That opens functions meant for internal use only. Arista says it can also "affect the VCO host" and compromise the orchestrator and the data it manages. VCO is the management plane for VeloCloud SD-WAN, the product line formerly sold as VMware SD-WAN by VeloCloud, which Arista bought from Broadcom.

This is the third VCO flaw Arista has reported as exploited since late July, after CVE-2026-16812 and CVE-2026-93952 (The Hacker News). It is also the first of the three that needs a login. Arista has not said when the attacks started, who is behind them, or what attackers did after getting in.

Who is affected#

• On-prem VCO before 5.2.3.18 (5.2 train), 6.1.3.10 (6.1 train) and 6.4.2.12 (6.4 train).
• Not listed: the 7.0 train. Arista says versions not listed are not affected. It has not assessed end-of-support releases.
• Hosted and Dedicated VCO were affected, but Arista has already patched them.
• Not affected: VeloCloud Edges and Gateways, EOS, CloudVision, Arista Wi-Fi and the other platforms the advisory lists.

Do you really need to act?#

Yes, if you run VCO on-prem. The login requirement is a weak barrier. The minimum role is Enterprise Read Only, the lowest built-in tenant role. On an orchestrator a provider runs for many customers, every customer user is a possible attacker, and so is anyone holding a phished or reused password. Arista says VCO is exposed by default and that "there is no configuration that can prevent the exposure" (SecurityWeek).

Watch for a version trap. Upgrading after July or September does not protect you from this bug: 5.2.3.16 and 6.4.2.8 fixed the earlier flaws and are still affected. On the 6.1 train it cuts the other way. 6.1.3.10 fixes this bug, but Advisory 0183 still lists no 6.1 fix for CVE-2026-93952, and neither advisory says whether 6.1.3.10 includes one. On the 5.2 and 6.4 trains, 5.2.3.18 and 6.4.2.12 are later than every earlier fix.

For the July and September flaws, Arista warned that a compromised orchestrator could give access to the Edge devices it manages. The new advisory does not say whether that applies here, or whether upgrading removes access an attacker already has. CISA had not added the CVE to its Known Exploited Vulnerabilities catalog as of October 23. The latest catalog is dated October 21.

What to do now#

1. List every on-prem orchestrator and its exact release. Anything below 5.2.3.18, 6.1.3.10 or 6.4.2.12 is exposed.
2. Upgrade to 5.2.3.18 or 6.4.2.12 or later. On 6.1 or an unsupported train, upgrade, and ask Arista TAC how to cover CVE-2026-93952 as well.
3. Until the upgrade is done, restrict the VCO web interface to trusted administrative networks, block outbound ports the host does not need, and block 74.82.197.86 and 38.54.50.151 (BleepingComputer).
4. Review recent administrator activity and remove tenant accounts that no longer need access.
5. If anything looks wrong, preserve evidence before patching: VCO web access logs, backend application logs, system logs, database logs and file-system timestamps. Then contact Arista TAC.

How to tell if you were hit#

Arista lists two attacker IPs and a log pattern. Search VCO web access logs for requests from 74.82.197.86 and 38.54.50.151. Also look for URL-like path components, encoded characters, references to local or internal services, and high request rates from one session. On the host, look for unexpected outbound connections, new daemons and webshells. In the application, look for operator-level changes you cannot account for, especially ones tied to low-privilege tenant sessions. A clean upgrade does not clean a host that was already compromised. If you find signs of compromise, treat the orchestrator and the Edges it manages as suspect.

Timeline#

• Jul 27, 2026 — Arista discloses exploited VCO flaw CVE-2026-16812 (Advisory 0144). CISA adds it to KEV.
• Sep 22, 2026 — Arista discloses a second exploited VCO flaw, CVE-2026-93952 (Advisory 0183), with fixes for the 5.2 and 6.4 trains only. CISA adds it to KEV.
• Oct 22, 2026 — Arista publishes Advisory 0199 for CVE-2026-114625, noting active exploitation. Hosted VCO is already patched.
• Oct 23, 2026 — Not in CISA KEV (catalog version 2026.10.21).

Vulnerability records

• CVE-2026-114625 · VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Arista — Security Advisory 0199 (CVE-2026-114625) arista.com
2. CVE record — CVE-2026-114625 cve.org
3. Arista — Security Advisory 0183 (CVE-2026-93952) arista.com

Coverage and analysis

1. The Hacker News — Arista warns of critical VeloCloud SQL injection zero-day exploited in attacks thehackernews.com
2. SecurityWeek — Attackers exploit third VeloCloud Orchestrator zero-day in four months securityweek.com
3. BleepingComputer — Arista patches new VeloCloud Orchestrator zero-day exploited in attacks bleepingcomputer.com