Arista VeloCloud CVE-2026-114625: Read-Only Account to Operator, Exploited Now

Arista disclosed a SQL injection zero-day in VeloCloud Orchestrator (VCO) On-Prem today and said it is already being exploited. The detail that should move this to the top of tonight's work: the attacker does not need an admin. A holder of Enterprise Read Only — the lowest built-in tenant role, the account you hand to someone who is only supposed to look at dashboards — can inject their way to operator, the superuser of the orchestrator that programs every SD-WAN edge you run. VCO is exposed by default, and Arista says no configuration removes that exposure.

Developing story — first published 22:18 CEST (20:18 UTC), 2026-10-22. Updated as Arista and CISA publish more.

At a glance

CVE	CVE-2026-114625
Product / affected versions	VeloCloud Orchestrator On-Prem; 5.2.x before 5.2.3.18; 6.1.x before 6.1.3.10; 6.4.x before 6.4.2.12
Fixed in	5.2.3.18; 6.1.3.10; 6.4.2.12 (released 2026-10-22)
CVSS	9.9 Critical · CVSS v3.1 · scored by Arista · AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; also 9.4 CVSS v4.0; NVD not yet scored
Exploited in the wild	Yes · Arista detected it and states it is actively exploited
CISA KEV	Not listed (catalog version 2026.10.21)
Official advisory	Arista Security Advisory 0199

What Arista disclosed

The flaw is a classic CWE-89 SQL injection, tracked internally as BUG2043622. Arista scores it 9.9 on CVSS v3.1 and 9.4 on v4.0. The mechanics the Arista advisory describes are what make the score honest: with network access to the VCO web interface and any valid authenticated session, a low-complexity injection reaches privileged internal functionality and lets the attacker impersonate a local superuser operator account. No user interaction, no second bug, no social engineering. The PR:L in the vector is doing the work — the precondition is "a login," and the scope change (S:C) is the jump from a confined tenant to control of the host.

Why that precondition is lower than it sounds: SD-WAN orchestrators accumulate accounts. Managed service providers hold them. Read-only auditors hold them. Decommissioned integrators sometimes still hold them. Any one of those credentials — or a single reused password in a credential-stuffing list — is now a path to operator, and BleepingComputer's report confirms attackers are already walking it.

This is the third VeloCloud Orchestrator zero-day in a quarter. In July, CVE-2026-16812 was an unauthenticated command injection that earned a three-day CISA clock. The pattern is not an accident: the orchestrator is a single management plane that touches hundreds of branches, so one bug there is worth more to an attacker than a bug anywhere downstream. Compromise VCO and you can push configuration, routes, and firmware to every edge it manages.

Who is exposed, and how to check your version

Only VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom) needs your action. Arista's hosted and dedicated VCO environments were affected too but are already patched on their side. End-of-support release trains were not assessed — if you run one, assume exposed.

Check the running build in the VCO UI (About / version panel) or on the orchestrator host. You are vulnerable if you are below the fixed build on your branch:

Release train	Affected	Fixed build
5.2.x	before 5.2.3.18	5.2.3.18
6.1.x	before 6.1.3.10	6.1.3.10
6.4.x	before 6.4.2.12	6.4.2.12

Remediation

1. Am I affected?

Confirm the VCO build against the table above. If the web interface is reachable from anything wider than a locked-down management network, treat it as internet-exposed — Arista states VCO is exposed by default and nothing in the product configuration prevents it.

2. Patch — exact fixed versions

Upgrade to 5.2.3.18, 6.1.3.10, or 6.4.2.12 (or later on your train), per Advisory 0199. On an unsupported train, contact Arista TAC about an upgrade path rather than staying put. Because exploitation needs only a valid session, patching is the only control that closes the hole — everything below buys time, not safety.

3. Can't patch now? — compensating controls

• Restrict the VCO web interface to trusted administrative networks. This is the single highest-value stopgap, because it removes the "network access to the web interface" half of the precondition for anyone outside your admin segment.
• Block the known attacker IPs at the perimeter: 74.82.197.86 and 38.54.50.151.
• Block unneeded outbound ports from the VCO host and alert on unexpected egress — a compromised orchestrator reaching out is a high-fidelity signal.
• Prune stale tenant accounts now. Every Enterprise Read Only credential is an exploitation primitive until you patch.

4. Hunt for compromise

Arista's own guidance is to assume the possibility of compromise and look. Map the hunt to ATT&CK:

• Initial access / exploitation (T1190): review VCO web access logs for unusual URL-like path components, encoded characters, references to local or internal services, and abnormally high request rates — the fingerprint of injection probing.
• Persistence (T1505.003): hunt for webshells and unexpected backdoor daemons on the VCO host.
• Command and control (T1071): check connection logs for the two IOC IPs above and for any unexpected outbound sessions from the orchestrator.
• Privilege / tampering: review recent administrator activity for changes nobody owns — new operator-level accounts, altered edge configuration, unexpected firmware or route pushes.

5. Eradicate and verify

If you find any of the above, preserve evidence before you clean: VCO web access logs, backend application logs, system logs, database logs, and the relevant file-system timestamps, as Arista advises, then engage TAC. A superuser operator compromise means the orchestrator's own records can no longer be trusted uncritically — rebuild from a known-clean image rather than cleaning in place, rotate every credential and API token the orchestrator could reach, and only then confirm the fix by re-testing the injection path, not by reading a higher version string.

What is not known yet

• No CVSS or record from NVD yet, and the CVE is not in the CISA KEV catalog as of catalog version 2026.10.21. Given an actively exploited, critical flaw in a mass-deployed management plane, a KEV listing with a short BOD 26-04 deadline is a realistic near-term outcome; do not wait for it to act.
• No public attribution and no exploitation volume. Arista names two IOC IPs but has not characterized the actor or the scale.
• No public proof-of-concept has been reported, but with the mechanism (authenticated SQL injection) now described, assume the window is short.

The honest way to know if it already happened

A read-only account turning into a superuser operator leaves almost nothing in the places most teams look. The orchestrator's own audit trail is exactly what the attacker now controls, and Arista's advisory quietly concedes this — it tells you to watch for outbound traffic from the VCO host, for webshell and backdoor-daemon callbacks, for connections to two specific IPs. That is detection advice pointing at the network, because after an operator-level compromise the network is the one witness the attacker cannot rewrite.

This is the case Zero Hunt's AI Traffic Analysis was built for. Its deep-learning model runs four inference heads — suspicious traffic, malware classification, attack-type identification, application fingerprinting — against billions of PCAP sequences at 2.7+ Gbit/s on the appliance GPU, on-premise, with nothing leaving the box. An orchestrator that suddenly beacons to a never-seen destination, a VCO host pushing configuration no operator requested, a webshell's callback — these are anomalies on the wire while they happen, not a line in tomorrow morning's SIEM digest. And because the flaw's real precondition is "a valid login," our autonomous AI red team tests it the way the attacker does: a gray-box campaign authenticated with a low-privilege tenant credential, generating a per-target injection attempt to prove whether that read-only account can actually reach operator on your build — black-box by default, human-approved for anything that touches the host, every finding signed at write time. When it confirms the path, the Remediation Advisor ranks the fix by real exploitability — exploited-in-the-wild first, then proven-reachable in your environment, then CVSS and EPSS — hands you the exact fixed build with rollout and rollback notes and the admin-network restriction as the compensating control, and re-verifies with the same proof that found it. Talk to us if VeloCloud sits between you and your branches, or read how automated penetration testing turns a disclosure like this into a same-day answer instead of a maintenance-window guess.