CVE-2026-114625 lets any VeloCloud Orchestrator login, even read-only, seize operator rights. It is exploited and needs a patch now.
Picture the intern who was only allowed to look at the network dashboard, now logging in as the person who runs it. That is what CVE-2026-114625 does to Arista's VeloCloud Orchestrator, and attackers were using it before a patch existed.
It is also the third exploited zero-day in this one product since late July. If you manage SD-WAN for clients, this one is for you.
TL;DR
CVE-2026-114625 is a SQL injection flaw in on-prem VeloCloud Orchestrator. It lets any authenticated user reach "privileged internal functionality and impact the VCO host," per Arista's advisory. VCO is the web console that configures and manages VeloCloud SD-WAN networks and their edge devices. Arista bought the line from Broadcom; it used to be VMware SD-WAN by VeloCloud.
SQL injection, in one clause: the attacker types database commands where the app expected ordinary input, and the database runs them. Here it turns the weakest account into the strongest one. Arista scores it CVSS 9.9 (v3.1) and 9.4 (v4.0). It warns that a successful attack may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.
Yes. Arista states CVE-2026-114625 is known to be actively exploited, and it names two attacker IPs: 74.82.197.86 and 38.54.50.151. Arista has not said when attacks began, who was hit or who is behind them. No public proof-of-concept has been reported.
The pattern matters. The Hacker News counts this as the third VCO flaw Arista has reported as exploited since late July, after CVE-2026-16812 in July and CVE-2026-93952 in September. The earlier two needed no login at all. CVE-2026-93952 has been on CISA's KEV catalog since 2026-09-22. CVE-2026-114625 is not on CISA's KEV catalog as of 2026-10-23.
Only on-prem VeloCloud Orchestrator is affected. Hosted and Dedicated VCOs were already patched by Arista. VeloCloud Gateway and VeloCloud Edge are not affected, and the 7.0 train is not on the list.
| Train | Vulnerable | Fixed in |
|---|---|---|
| 5.2 | before 5.2.3.18 | 5.2.3.18 and later |
| 6.1 | before 6.1.3.10 | 6.1.3.10 and later |
| 6.4 | before 6.4.2.12 | 6.4.2.12 and later |
Arista has not assessed end-of-support releases; clients on those should open a case with Arista TAC. One trap for 6.1: Arista's September advisory lists no fixed 6.1 release for CVE-2026-93952, and neither advisory says whether 6.1.3.10 fixes it. Keep 6.1 orchestrators locked to admin networks even after upgrading.
"It needs a login" is little comfort here. Arista says VCO is exposed by default, and no configuration prevents that exposure. Every reseller, branch admin and auditor holding a read-only seat is now a possible way in. So is every stolen password.
Upgrade every on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. Then work through each client:
grep -rE '74\.82\.197\.86|38\.54\.50\.151' /var/log/ and find /var/log -name '*.gz' -exec zgrep -HE '74\.82\.197\.86|38\.54\.50\.151' {} + for rotated logs. Run the same IP search in each client's firewall and proxy logs too./usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond and /etc/systemd/system/vc-sysmon.service. Check for those too.Arista does not say whether upgrading removes access an attacker already has. Treat a confirmed hit as an incident: rotate VCO credentials, check managed devices, and rebuild the orchestrator from trusted sources.
The confirmed lesson applies to every client: management consoles that sit on the internet by design are standing targets. Three VCO zero-days in about three months prove it. KinoSec's autonomous pentest maps each client's external surface and flags exposed admin panels like a VCO login page, so you know which clients' builds to check against Arista's fixed releases. The second lesson is that "requires a login" is not a stopping point. With a low-privilege test account the client provides, KinoSec's authenticated pentesting checks what that account can actually reach, the class of privilege-escalation path CVE-2026-114625 abuses. The result is a report you can hand your client, with findings and remediation, run on your schedule rather than after the next advisory.
CVE-2026-114625 is an actively exploited SQL injection flaw in Arista VeloCloud Orchestrator On-Prem, rated CVSS 9.9. Any authenticated user, including the Enterprise Read Only role, can gain operator privileges and masquerade as the local "superuser operator." Arista disclosed it in Security Advisory 0199 on October 22, 2026.
Search the VCO host's /var/log/ (including rotated .gz files) and each client's firewall and proxy logs for 74.82.197.86 and 38.54.50.151. Review VCO web access logs for unusual URL-like path components, encoded characters, references to local or internal services, and high request rates. Look for webshells, backdoor daemons, unexpected outbound traffic and unexplained administrator changes.
Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. Until then, restrict the VCO web interface to trusted administrative networks. Hosted and Dedicated VCOs are already patched, and VeloCloud Gateway and Edge are not affected.
No. Releases that fixed CVE-2026-16812 and CVE-2026-93952 are older than the new fixed builds, so they remain vulnerable to CVE-2026-114625. Every client's on-prem VCO must move to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later.
Yes. An external pentest such as KinoSec's finds internet-facing VCO login pages across a client's address space. With a client-provided test account, it also checks what a low-privilege login can reach. Matching each finding against Arista's fixed builds tells you which clients need the upgrade first.