CISA flags exploited VeloCloud Orchestrator flaw as patch deadline nears

A newly listed security flaw in Arista’s VeloCloud Orchestrator can turn a low-privilege customer login into top-level operator access. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog on October 23, with an October 26 remediation deadline for covered federal agencies.

For organizations managing their own VeloCloud deployment, the immediate task is to check the orchestrator’s software version and investigate suspicious activity, not simply confirm that the network’s edge devices are patched. Arista says the flaw is already being exploited and has released fixes for three supported software branches.

This article was published on October 25, 2026, UTC. Arista disclosed the vulnerability on October 22; CISA’s subsequent catalog addition is the latest development.

A read-only account can reach operator privileges

The vulnerability, CVE-2026-114625, affects the on-premises version of VeloCloud Orchestrator, the central management component for VeloCloud software-defined wide area networks, or SD-WANs. These systems help organizations manage connectivity across distributed locations.

According to Arista’s security advisory, the problem is SQL injection: a failure to handle database input safely that can allow an attacker to interfere with database operations. On an affected orchestrator, an authenticated user can gain operator privileges and impersonate a local “superuser operator.”

That is a substantial change in authority. The minimum account role needed is Enterprise Read Only, the lowest built-in tenant role. A customer account that should only be able to inspect information can therefore become a route to privileged internal functionality.

There are important limits to the attack scenario. The attacker needs network access to the orchestrator’s web interface and a valid authenticated session. This is not described as an unauthenticated attack that anyone on the internet can launch without credentials.

Arista assigns the flaw a severity score of 9.9 under the Common Vulnerability Scoring System version 3.1. It warns that exploitation could affect the orchestrator host and compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.

Which deployments need an update

Arista identifies three affected software branches: VCO 5.2.x before 5.2.3.18, VCO 6.1.x before 6.1.3.10, and VCO 6.4.x before 6.4.2.12. The fixes are those releases or later versions within their respective branches.

Hosted versions, including Dedicated orchestrators, were affected but have already been patched, according to the company. VeloCloud Gateway and VeloCloud Edge are not affected by this particular vulnerability. Administrators should avoid treating that exclusion as evidence that their separate management server is safe.

Arista says software releases not listed in the advisory are not vulnerable, but it also cautions that end-of-support versions have not been assessed. Organizations using unsupported releases should contact its Technical Assistance Center about upgrade options rather than assume an unlisted legacy deployment has been cleared.

The Hacker News reported on October 24 that CISA had added the flaw to its exploited-vulnerability catalog, corroborating the new federal warning after Arista’s disclosure.

What CISA’s October 26 deadline means

CISA’s official catalog data records an October 23 addition date and an October 26 due date for CVE-2026-114625. The entry also marks forensic triage as required and directs covered organizations to follow the agency’s applicable mitigation and investigation guidance.

The federal deadline should not be presented as a universal legal obligation for every business or home user. Its practical significance outside government is that an actively exploited management-system flaw has received an urgent remediation timetable.

The catalog lists use in known ransomware campaigns as “Unknown.” That is not confirmation of ransomware involvement, nor proof that such involvement is absent. Arista has not publicly identified the attackers, quantified affected organizations or described their actions after gaining elevated access.

Restrict access and preserve evidence

While preparing an upgrade, Arista recommends restricting the VCO web interface to trusted administrative networks. It also recommends monitoring unexpected outbound traffic, reviewing recent administrator activity, and looking for backdoor services and webshells, which are scripts attackers can use to maintain remote access.

The vendor identifies two source IP addresses observed conducting attacks: 74.82.197[.]86 and 38.54.50[.]151. It advises blocking them and checking logs for their presence. Those indicators are useful investigation leads, not a complete test that can establish whether a deployment is uncompromised.

Administrators should investigate unusual web requests, encoded characters, references to local or internal services, and unexpectedly high request rates. Where operationally feasible, Arista says to preserve web access, application, system and database logs, along with relevant file-system timestamps, before remediation if compromise is suspected.

For VPNReviews readers responsible for business connectivity, the relevant distinction is between protecting traffic and protecting the system that administers the network. A VPN connection does not repair an application’s privilege-escalation flaw. Restricting management access can reduce exposure, but installing the correct fix and assessing possible compromise remain the essential steps.