VeloCloud Orchestrator Has Its Third Exploited Flaw Since July. This One Turns a Read-Only Login Into Operator Control.
Arista said on October 22 that attackers are already exploiting CVE-2026-114625, a SQL injection in the VeloCloud Orchestrator web portal rated 9.9. Anyone with a login, down to the lowest Enterprise Read Only customer role, can take operator-level control of the Orchestrator. If you run VCO on premises, upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 now. Hosted and Dedicated orchestrators were already patched by Arista. VeloCloud Gateways and Edges are not affected.
Why this one matters more than the score
The Orchestrator is the box that pushes configuration to every SD-WAN site you have. Operator access on it is control of the network, not of one server. And the bar to get in is low: the attacker needs a valid account, but the weakest customer role will do. If you are a service provider running a shared Orchestrator, every customer login you have issued is a way in.
Arista says the web interface is exposed by default and no Orchestrator setting turns that off. Its interim advice is to restrict access to administrative networks and watch the logs.
The patch you applied last month is not enough
This is the third Orchestrator flaw to be exploited since July. CVE-2026-16812, an unauthenticated command injection rated 10.0, went into CISA's Known Exploited Vulnerabilities catalog on July 27. CVE-2026-93952 followed on September 22. The releases that fixed those two are older than the new fixed versions, so a box patched in September is still open to this one. Check the exact version, not the date of your last update.
What to do, in order
Upgrade on-premises Orchestrators to 5.2.3.18, 6.1.3.10 or 6.4.2.12.
Restrict the web portal to the networks your administrators use. It should not face the internet.
Review every customer account, including read-only ones. Remove the ones nobody needs, and look at what the rest did recently.
Block and hunt for the two IPs Arista published: 74.82.197.86 and 38.54.50.151. Arista links both to ongoing exploitation attempts.
What we hold
Neither IP was in our corpus before Arista named them. We have now added both to our feed at confidence 80 under source manual-batch-arista-velocloud-cve-2026-114625, cited to Arista. They are hosting addresses and may be shared, so treat a hit as a reason to look, not as proof. Other addresses in 38.54.0.0/16 appear in ThreatFox under unrelated campaigns, which says something about that hosting, not about this attack. Our edge cannot see this exploitation, because we do not run an Orchestrator.
Arista's advisory, as reported: The Hacker News on CVE-2026-114625 and BleepingComputer.
If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=velocloud-orchestrator-has-its-third-exploited-flaw-since-july-this-one-turns-a-read-only-login-int
Comments