Arista Networks — Patching New VeloCloud Orchestrator Zero-Day Exploited in Attacks (CVE-2026-114625)

Publication date: October 22, 2026
Category: Zero Days / Threat Intelligence

Introduction

Arista Networks has issued urgent security advisories and patches to address an actively exploited zero-day vulnerability affecting on-premises deployments of VeloCloud Orchestrator (VCO). Tracked as CVE-2026-114625, this critical-severity flaw allows attackers with basic privileges and web interface access to escalate privileges and compromise the host system. This disclosure follows a series of critical security incidents handled by Arista throughout 2026 impacting both SD-WAN management platforms and core routing operating systems.

What is VeloCloud Orchestrator and the Security Flaw? (General Analysis)

VeloCloud Orchestrator (VCO) is a centralized web-based management portal that enables administrators to configure, monitor, and manage VeloCloud Software-Defined Wide Area Networks (SD-WANs) and associated edge devices. Given its central role in enterprise network architecture, compromising this component poses a catastrophic risk to the confidentiality, integrity, and availability of managed infrastructures.

For the primary vulnerability CVE-2026-114625, NVD data was not included in the provided lookup quota; therefore, a reasoned estimation is established based on the reported vector behavior:

  • Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — 9.9 (CRITICAL) (Reasoned estimation).
  • Estimated CWE: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command / SQL Injection) or CWE-284 (Improper Access Control) (Reasoned estimation).

Additionally, several critical vectors discovered earlier in 2026 across Arista infrastructure feature official NVD verified records:

CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2026-7473 CWE-1023 Limited (Confidentiality/Integrity) 6.9 (MEDIUM) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N…
CVE-2026-16812 CWE-78 Critical (Full Compromise) 10.0 (CRITICAL) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H…
CVE-2026-93952 CWE-20 Critical (Full Compromise) 9.5 (CRITICAL) CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H…

Note: CVSS vectors, CWEs, and CISA KEV statuses for CVE-2026-7473, CVE-2026-16812, and CVE-2026-93952 are confirmed facts according to the official NVD database.

How Does It Work? (Technical Analysis)

The exploitation mechanism behind CVE-2026-114625 operates through specific operational stages:

  • Initial Entry Flow: An attacker possessing low-level credentials and access to the VeloCloud Orchestrator web interface submits crafted HTTP requests. The flaw requires no user interaction (zero-interaction).
  • Privilege Escalation and Persistence: Utilizing low-complexity SQL injection techniques, the authenticated user manipulates internal database queries executed by the orchestrator. This bypasses access controls, allowing the actor to masquerade as a local “superuser operator.”
  • Internal Operational Impact: Once superuser privileges are attained, the attacker gains access to internal functionalities intended exclusively for internal system usage, completely compromising the underlying VCO host and managed data.

“On an affected system, any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user, including access to functionality that is intended for internal use only.”

Affected Systems / Environments

Environments directly impacted by VeloCloud Orchestrator vulnerabilities include:

  • VeloCloud Orchestrator (VCO) On-Prem: Versions prior to the security patches released by Arista.
  • Hosted and Dedicated Deployments: Previously vulnerable instances that have already been patched by the vendor (including versions 5.2.x, 6.1.x, and 6.4.x).
  • Arista EOS Infrastructure: Devices affected by previous tunnel decapsulation flaws (CVE-2026-7473).

Mitigation and Detection

Remediation

  • Immediately apply security patches and updates provided by Arista Networks for the corresponding VCO and EOS versions.
  • If patching cannot be performed immediately, strictly restrict access to the VCO web interface to trusted internal management networks.
  • Preventatively block malicious IP addresses observed during active campaigns, specifically 74.82.197.86 and 38.54.50.151.
  • If compromise is suspected, preserve web access logs, backend application logs, system logs, database logs, and file-system timestamps prior to undertaking any remediation actions.

Detection

  • Monitor web access logs for anomalous patterns, such as requests containing unusual URL path components, encoded characters, references to local or internal services, and high request rates.
  • Audit recent administrator activity to detect unusual modifications to user privileges or unexpected operator account creation.

Wrapping Up

Active exploitation targeting critical network management platforms like VeloCloud Orchestrator highlights the pressing need for rigorous patch management and strict perimetric segmentation. The ability of threat actors to escalate privileges from low-level accounts emphasizes that traditional perimeter defense alone is insufficient when internal access control and input validation fail.

References