Arista VeloCloud Orchestrator: read-only users, now with superuser energy

Call: Patch now if you run VeloCloud Orchestrator on-prem. CVE-2026-114625 is a SQL injection that lets any authenticated user, down to Enterprise Read Only, promote themselves to a “superuser operator.” Arista says it’s being actively exploited. CISA added it to KEV on Oct 23. Arista scores it 9.9 on CVSS 3.1 and 9.4 on CVSS 4.0.

What breaks: Nothing breaks. The problem is who ends up in charge. A low-privilege login becomes the account that runs your SD-WAN.

Who’s hit:

On-prem VCO below 5.2.3.18, 6.1.3.10 or 6.4.2.12.
Arista has already patched Hosted and Dedicated VCO.
Arista hasn’t assessed end-of-support versions. Assume they’re affected, and treat that as one more reason to retire them.

Workaround:

Upgrade to 5.2.3.18, 6.1.3.10, 6.4.2.12 or later.
Until you can, restrict the web UI to admin networks.
Look for webshells and keep your logs.
Arista lists two attacker IPs, 74.82.197.86 and 38.54.50.151. It’s worth grepping for them.

This isn’t Arista’s first exploited zero-day this year, so if your read-only accounts have been piling up, now’s a good time to prune them.

Sources: Arista advisory 0199 (opens in a new tab), BleepingComputer (opens in a new tab), KEV weekly digest (opens in a new tab).

Arista VeloCloud Orchestrator: read-only users, now with superuser energy

Sources

More from October 2026 patch cycle