Hackers Exploit Critical Arista VeloCloud Orchestrator Flaw

Even a read-only login can give attackers privileged operator access through a critical flaw in Arista VeloCloud Orchestrator. Arista has confirmed active exploitation, making affected systems an immediate patching and investigation priority.

CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 23 after Arista confirmed attacks. The SQL injection flaw, rated 9.9 under CVSS v3.1, affects on-premises VeloCloud Orchestrator, a management system for software-defined wide-area networks (SD-WAN). Attackers need valid portal credentials, but even the lowest Enterprise Read Only role can lead to operator-level access. Administrators must check installed versions and investigate earlier activity, not merely schedule an upgrade.

Read-only access can lead to privileged operator control

In its Oct. 22 advisory, Arista warned that attackers with portal access could exploit the vulnerability to gain local superuser operator privileges and access restricted internal functions.

The company confirmed active exploitation but has not identified the attackers, disclosed the number of affected organizations, or detailed what happened after privilege escalation.

Arista said it had already patched hosted VCO services, including dedicated deployments. VeloCloud Edge and Gateway devices are not directly affected, while end-of-support Orchestrator releases have not been assessed.

CISA adds the flaw to its exploited vulnerabilities catalog

CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on Oct. 23, identifying it as a vulnerability exploited in real-world attacks.

The Hacker News said that this is the third actively exploited VeloCloud Orchestrator vulnerability disclosed since July, following CVE-2026-16812 and CVE-2026-93952. Organizations that applied fixes for those earlier flaws may still be vulnerable to the latest issue.

According to Arista's security advisory, affected on-premises deployments must be upgraded to version 5.2.3.18, 6.1.3.10, or 6.4.2.12, or later supported versions within their respective release branches. Earlier versions in those branches remain vulnerable.

Private organizations running affected systems should also prioritize remediation. With exploitation already confirmed, administrators should verify their installed versions rather than assume previous security updates provide protection. A separate actively exploited SharePoint vulnerability similarly highlights the need to check installed builds and investigate possible compromise.

Security teams must investigate beyond patching

For enterprises and managed network providers, the immediate concern is that a compromised low-privilege account could expose administrative functions within a centralized SD-WAN management system. A separate actively exploited Cisco SD-WAN Manager flaw also exposed administrative access.

Aviatrix identified potential consequences of such access, including lateral movement and data theft. These remain possible attack scenarios rather than confirmed outcomes of the current exploitation campaign.

Security teams should prioritize three actions:

• Verify and patch affected systems. Check the running Orchestrator version against Arista's latest fixed releases. Organizations using unsupported versions should contact Arista for guidance.
• Restrict administrative access. Limit the VCO web interface to trusted networks and review read-only, partner, and administrative accounts for unnecessary access or suspicious activity.
• Investigate possible compromise. Examine unusual web requests, unexpected administrator changes, outbound connections, and other signs of unauthorized access. If compromise is suspected, preserve relevant logs and file-system timestamps before remediation where operationally feasible.

Arista identified 74.82.197.86 and 38.54.50.151 as IP addresses observed conducting attacks. However, their absence from security logs does not rule out a potential compromise.

Organizations managing multiple branches or customer environments should coordinate with network administrators to review configuration changes, assess potentially compromised credentials, and determine whether further incident response is needed. Credential exposure is also a concern in the separate SAP Cloud SDK vulnerability, which could expose secrets used to access connected services.

For security leaders, installing the update is only part of the response. It addresses the vulnerability but does not establish whether attackers previously gained privileged access or left another way into the system. Teams should review historical activity and investigate suspicious changes before declaring the incident resolved.

Also read: VeloCloud isn't the only platform facing active attacks. Hackers are also exploiting a critical Collabora flaw to compromise Nextcloud servers with web shells.