VeloCloud Orchestrator CVE-2026-114625 is actively exploited
News date: 2026-10-22 · Sources reviewed: 2026-10-23
On October 22, 2026, Arista released Security Advisory 0199 covering CVE-2026-114625 in VeloCloud Orchestrator (VCO) On-Prem. The SQL-injection vulnerability carries a CVSS v3.1 rating of 9.9 and is known to be actively exploited.
What the attacker can do
An authenticated user with a low-privilege VCO role may escalate to operator privileges and access internal functionality. Exploitation requires network access to the management interface and a valid session. This is not an unauthenticated flaw affecting every SD-WAN device.
- Scope is the on-premises VeloCloud Orchestrator platform.
- VeloCloud Edge and Gateway are not in the affected-product list.
- According to Arista, impacted hosted environments had already been patched.
Affected and fixed software
Arista lists VCO 5.2.x prior to 5.2.3.18, 6.1.x prior to 6.1.3.10 and 6.4.x prior to 6.4.2.12 as affected. Fixed builds are 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later in their respective branches. Unsupported releases require vendor guidance.
- Inventory the deployment model and exact VCO software branch.
- Schedule a controlled upgrade with tested backup and rollback arrangements.
- Do not mistake external filtering for a substitute for remediation.
Look for evidence of prior access
Patching removes the vulnerability but does not necessarily eliminate an existing compromise. Arista observed attacker IP addresses 74.82.197.86 and 38.54.50.151. Their absence from logs does not establish that a system was never targeted.
- Restrict the management interface to trusted administrative networks while updating.
- Review web, application and system logs, unexpected account changes and outbound traffic.
- Preserve evidence and timestamps before remediation when compromise is suspected.
Operational perspective
A central SD-WAN orchestrator is an important management control plane. Its security impact should be assessed separately from individual edge appliances. Effective response combines exposure assessment, patch deployment and validation of normal behavior.
- Assign an owner and planned maintenance window.
- Validate connectivity and configuration after patching.
- Record the exposure and remediation decision in the risk register.
VALUE360: Network vulnerability management should be evidence-based, production-aware and supported by post-change verification.
Explore the related VALUE360 service →
Sources
Change planning and resilience
Review application dependencies, permissions, backup procedures and recovery objectives before making changes. Documentation and tested recovery are as important as initial configuration.
Implementation questions
Does this automatically affect our environment?
No. First verify whether the specific product, version and relevant configuration are deployed.
Is a security tool enough on its own?
No. Combine patching, restricted access, logging and tested backups.