CYBUNKR

VeloCloud SD-WAN orchestrator flaw under attack

Published

Arista says attackers are exploiting CVE-2026-114625 in on-premises VeloCloud Orchestrator, the console that runs VeloCloud SD-WAN. Any logged-in user, even read-only, can become a superuser. Who is exposed and what to ask your provider.

If your sites connect over VeloCloud SD-WAN, find out who runs the orchestrator, and check it today. Arista's advisory says an SQL injection flaw in VeloCloud Orchestrator (VCO) on-prem, CVE-2026-114625, lets any authenticated user gain operator privileges and masquerade as a local “superuser operator”. Arista says it “is known to be actively exploited” and rates it critical, 9.9 out of 10 (CVSS v3.1). On 23 October CISA added it to its Known Exploited Vulnerabilities catalog.

Who is affected

  • VCO on-prem 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12 (Arista). End-of-support versions haven't been assessed.
  • The lowest login is enough. Arista says the attacker needs network access to the VCO web interface and a valid session with at least the Enterprise Read Only role, the lowest built-in tenant role. VCO is exposed by default and no configuration prevents the exposure.
  • Hosted VCO, including Dedicated, was also affected, and Arista says it has already been patched.
  • Not the edge boxes: Arista lists VeloCloud Edge and VeloCloud Gateway as not affected.

If a provider manages your SD-WAN for you, the orchestrator may be one they host themselves, and your tenant logins sit on it. That makes this a question for them as much as for your own team.

What has been seen so far

A snapshot from 25 October:

  • Arista says it detected the issue itself and that it is being actively exploited. It lists two IP addresses seen conducting the attacks: 74.82.197.86 and 38.54.50.151.
  • CISA listed it as known exploited on 23 October and gave US federal agencies until 26 October to act. It records use in ransomware campaigns as “unknown”.
  • The NVD record was published on 22 October, the same day as Arista's advisory.

What to do

  • Upgrade VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later in your release train. If you aren't on a supported train, Arista asks you to contact its TAC about upgrade options.
  • If your SD-WAN is managed, ask your provider whether their orchestrator is on-prem, whether it is on a fixed release, and whether they have checked its logs for the IP addresses above.
  • Until it is patched, Arista advises restricting the VCO web interface to trusted administrative networks, blocking the two IP addresses, watching for unexpected outbound traffic, backdoor daemons and web shells, and reviewing recent administrator changes.
  • Trim VCO accounts: because a read-only login is enough, remove users who no longer need access.
  • If you suspect compromise, Arista asks operators to preserve VCO web access, application, system and database logs and file-system timestamps before fixing anything.

How we can help

If you think your orchestrator has been accessed, our Incident Response service can help, or get in touch.

Sources