Arista patches actively exploited VeloCloud flaw that turns read-only users into superusers

Arista Networks has released fixes for an actively exploited vulnerability in VeloCloud Orchestrator, the management platform for its software-defined wide area networking service. An attacker with a valid login—even the lowest built-in customer role—can use the flaw to gain operator privileges and impersonate a local superuser.

The company disclosed the issue on October 22, 2026, in Security Advisory 0199. Hosted deployments, including Dedicated instances, have already been patched, Arista says. Organizations running their own orchestrators need to check their versions and install the appropriate fixed release.

The immediate concern is the management system, not a newly disclosed defect in every VeloCloud networking device. Arista explicitly lists VeloCloud Edge and VeloCloud Gateway as unaffected by this vulnerability.

A management account becomes a route to higher privileges

Tracked as CVE-2026-114625, the vulnerability is a SQL injection flaw. SQL injection occurs when an application does not properly separate supplied input from database commands. Here, Arista says exploitation can expose privileged internal functionality and affect the orchestrator host itself.

VeloCloud Orchestrator centrally manages SD-WAN, or software-defined wide area networking, which organizations use to connect and administer networks across locations. That management role makes a privilege-escalation vulnerability consequential: a customer account intended only to view information can become a route to much broader control.

An attacker must have network access to the orchestrator’s web interface and a valid authenticated session. The minimum required role is Enterprise Read Only, the lowest built-in tenant role. This is therefore not an unauthenticated attack, but neither does it require an administrator’s account.

Arista rates the issue 9.9 under the Common Vulnerability Scoring System’s version 3.1 framework and 9.4 under version 4.0. Both ratings indicate critical severity. The company says successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages—in practical terms, exposing information, allowing changes or disrupting service.

Which VeloCloud releases need an update?

The advisory identifies three affected software branches. In the 5.2 branch, releases before 5.2.3.18 are vulnerable; in 6.1, releases before 6.1.3.10 are vulnerable; and in 6.4, releases before 6.4.2.12 are vulnerable.

The corresponding fixed releases are VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12, or later releases within their respective branches. Administrators should match their installed branch against the advisory rather than treating one version number as a universal upgrade target.

Arista says software versions that have reached end of support have not been assessed. That distinction matters: an unsupported deployment should not be assumed safe simply because it does not appear in the assessed release list. Customers outside a supported release train should contact Arista’s Technical Assistance Center about upgrade options.

Hosted and Dedicated customers have a different immediate task: Arista says those orchestrators were affected but have already received patches. Customers should still review relevant security notifications and investigate any signs of unauthorized activity; a patched service does not, by itself, establish that no earlier intrusion occurred.

Active attacks are confirmed, but their scope is not disclosed

Arista states that it detected the issue and knows it is being actively exploited. Its advisory does not identify the attackers, provide a victim count or say when exploitation began. Those unanswered questions should not be filled with assumptions about a particular ransomware group or campaign.

The company lists two source IP addresses observed conducting attacks: 74.82.197.86 and 38.54.50.151. It advises operators to block them and check whether they appear in logs. Their absence should not be treated as proof that an installation is clean; the advisory also recommends reviewing broader signs of suspicious access.

Those signs include high request rates, unusual URL-like path components, encoded characters and requests referring to local or internal services. Administrators should also examine recent administrative changes and unexpected outbound traffic from the orchestrator host.

SecurityWeek’s October 23 reporting corroborates the disclosure and notes that it follows exploited VCO vulnerabilities disclosed in July and September. Having installed an earlier security update is not a reason to skip this new version check.

Restrict access while arranging the patch

Arista recommends upgrading as the resolution. Until fixed software is deployed, it advises restricting the web interface to trusted administrative networks, monitoring access from known malicious sources and considering blocks on outbound ports not needed for normal operation.

Security teams should also watch for backdoor services and webshells—malicious scripts that provide remote access through a web server—and review recent administrator activity. These measures reduce exposure and help detect compromise; they are not substitutes for the fixed software.

Where an intrusion is suspected, Arista recommends preserving web access, backend application, system and database logs, together with relevant file-system timestamps, before remediation when operationally feasible. That evidence can help establish what happened and whether further response is needed.

For VPNReviews readers, the important distinction is between an enterprise network’s management plane and a consumer VPN app. This advisory is not a report that consumer VPN subscriptions have been breached. A personal VPN connection also cannot repair an organization’s vulnerable orchestrator or prevent an authenticated attacker from exploiting it. The useful next step for affected businesses is specific: verify the VCO release, apply the correct patch and review evidence of access.