CVE-2026-114625: Arista VeloCloud Orchestrator Flaw Gives Any Logged-In User Operator Rights

Background

VeloCloud Orchestrator (VCO) is the management plane for VeloCloud SD-WAN deployments. Arista’s advisory lists the product as formerly “VeloCloud Orchestrator by Broadcom”. Operators use it to manage tenants and enterprise customers. In our assessment, a compromised orchestrator is a strong position inside an SD-WAN estate.

Arista published Security Advisory 0199 on 22 October 2026. It covers only the on-prem VCO. Arista says hosted versions, including Dedicated, were affected and have already been patched. Arista’s list of unaffected products includes VeloCloud Gateway and VeloCloud Edge, as well as its EOS and CloudVision lines.

Technical Mechanism

Arista classifies the flaw as CWE-89, Improper Neutralization of Special Elements used in an SQL Command (SQL injection). CISA’s KEV entry uses the same CWE and names the issue “Arista VeloCloud Orchestrator SQL Injection Vulnerability”.

Arista’s description is that, on an affected system, any authenticated user can gain operator privileges and masquerade as a local “superuser operator” user. That includes functionality intended for internal use only, which is not meant to be remotely accessible. Arista says successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and its data, and may impact the VCO host.

Arista states that “VCO is exposed by default” and that no configuration can prevent the exposure. Exploitation requires network access to the VCO web interface and a valid authenticated session on the VCO portal. The lowest role that works is Enterprise Read Only, the lowest built-in tenant role. Our reading: any tenant account is enough, which matters for multi-tenant and partner-operated deployments.

Arista’s advisory does not publish the vulnerable endpoint, parameter or query, and we found no evidence of a public proof of concept as of 26 October 2026 in the Arista advisory, the NVD record or the CISA KEV entry. We do not describe the injection path beyond what Arista and CISA state.

Real-World Exploitation Evidence

Arista’s advisory states: “This issue was detected by Arista and is known to be actively exploited.” Arista lists two source IP addresses it observed conducting attacks: 74[.]82[.]197[.]86 and 38[.]54[.]50[.]151.

CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities catalog on 23 October 2026 with a due date of 26 October 2026. The entry lists known ransomware campaign use as “Unknown” and sets forensic triage to “Yes”.

We found no named threat actor or campaign attached to this exploitation as of 26 October 2026 in the Arista advisory, the CISA KEV entry or the NVD record. We could not open press coverage of the exploitation, so we cannot say how many organisations were affected.

Impact Assessment

With operator-level rights on the orchestrator, an attacker works with whatever the orchestrator manages. Arista’s wording covers confidentiality, integrity and availability of the orchestrator, the data it manages and the VCO host. We have no vendor detail on what specific actions attackers have taken after exploitation.

In our assessment, risk is highest where:

• The VCO web interface is reachable from the internet, since the exposure cannot be configured away.
• The VCO serves several tenants, partners or customers, so a low-privilege account exists for many parties.
• Credentials for low-privilege VCO accounts could have leaked, because those accounts alone satisfy the precondition.

The CVSS 3.1 scope metric is Changed (S:C), which reflects impact beyond the vulnerable component.

Affected Versions

Arista’s advisory lists these on-prem VCO releases as affected and notes that end-of-support versions have not been assessed.

The CVE record lists the same ranges. CVSS scores are published by Arista as the CNA: 9.9 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and 9.4 under CVSS 4.0. NVD shows both as Secondary (CNA) scores. We did not see an NVD-primary score. The cvssScore in this article is Arista’s 3.1 figure.

Remediation Steps

1. Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later, matching your release train.
2. If you are on an unsupported release train, contact Arista TAC about upgrade options, as the advisory directs.
3. Until patched, restrict access to the VCO web interface to trusted administrative networks.
4. Block 74[.]82[.]197[.]86 and 38[.]54[.]50[.]151 (the addresses Arista lists) at the perimeter.
5. Before remediation, where practical, preserve VCO web access logs, backend application logs, system logs, database logs and file-system timestamps. CISA’s KEV entry also points to its forensic triage requirements under BOD 26-04.
6. Review recent administrator activity on the VCO for changes nobody made.
7. US federal civilian agencies were required to act by 26 October 2026 under BOD 26-04.

Detection Guidance

Arista’s advisory lists the first four checks below. The last item is our addition.

• Review VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates.
• Search access logs and firewall logs for 74[.]82[.]197[.]86 and 38[.]54[.]50[.]151.
• Monitor for unexpected outbound network activity from the VCO host. Consider blocking outbound ports not needed for normal operation.
• Look for backdoor daemons and web shells on the VCO host.
• Review recent administrator activity for unexpected changes (Arista).
• Our addition: look for operator-level actions by accounts that should hold only tenant roles.

Arista has not published request signatures, so these checks are behavioural. Two IP addresses are the only network indicators Arista lists.

Timeline

References

• Arista Security Advisory 0199 (arista.com)
• NIST NVD, CVE-2026-114625
• CISA, BOD 26-04 Prioritizing Security Updates Based on Risk