VeloCloud Vulnerability CVE-2026-114625 Exploited: Patch Now

Last updated: 26 October 2026. Sources are listed at the end.

Arista has fixed an actively exploited VeloCloud vulnerability in the on-premises VeloCloud Orchestrator (VCO), the management console for VeloCloud SD-WAN. The bug is tracked as CVE-2026-114625. It is a SQL injection flaw rated 9.9 under CVSS 3.1, and Arista published its advisory (Security Advisory 0199) on 22 October 2026.

A day later, on 23 October, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue. According to The Hacker News and the cvefeed.io record, the KEV due date for US federal agencies is 26 October 2026. That is today. Outside the US the date is not binding, but it shows how urgent CISA considers the fix.

This matters mostly to organisations and managed service providers that run their own orchestrator. Arista says its hosted and dedicated VCO services were also affected, but it has already patched them. If you only manage branch edges through a hosted orchestrator, your to-do list is shorter.

The short answer

• If you run VCO on-premises, upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 (or later) on your release train.
• Until then, allow the VCO web interface only from trusted admin networks, and block 74.82.197.86 and 38.54.50.151.
• Review every portal account, because any logged-in user, even read-only, can abuse this flaw.
• Search your web access logs for the two IPs and for injection-style requests, and preserve logs before you change anything.
• If you find signs of abuse, treat the orchestrator and its managed edges as part of one incident.

Who owns VeloCloud now?

The product has changed hands several times, which confuses people looking for the right advisory. VMware bought VeloCloud in 2017. Later, VeloCloud passed to Broadcom when Broadcom took over VMware. Then, in July 2025, The Register reported that Arista Networks had acquired the VeloCloud SD-WAN business from Broadcom. As a result, current VCO security advisories come from Arista, not from VMware or Broadcom pages.

What is the VeloCloud vulnerability?

Arista classes CVE-2026-114625 as CWE-89, SQL injection. In simple terms, part of the orchestrator passes user input into a database query without enough checking. An attacker can therefore change what that query does.

The effect is serious. Per the advisory, any authenticated user can gain operator privileges and act as a local “superuser operator”. That role includes internal-only functions which were never meant to be reachable from outside. Arista also says a remote attacker may affect the VCO host itself.

So, is it pre-authentication? No. The attacker needs two things:

1. Network access to the VCO web interface.
2. A valid, logged-in portal session. The minimum role is Enterprise Read Only, the lowest built-in tenant role.

However, that bar is low. A leaked, phished or reused password for any tenant user is enough. In addition, Arista notes that VCO is exposed by default and no setting removes that exposure. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and the CVSS 4.0 score is 9.4.

Timeline

Exploitation status: what is confirmed

Confirmed by Arista: the issue “is known to be actively exploited”, and Arista detected it itself. No outside researcher is credited. Arista has also published two attacker IP addresses.

Not disclosed: who is behind the attacks, how many customers were hit, and what attackers did after gaining access. The Hacker News notes that the two IPs geolocate to Japan, but that says little about the real operators. We found no public proof-of-concept code.

This is also the third VCO flaw exploited in the wild since July 2026, according to The Hacker News. The earlier two were CVE-2026-16812 (command injection, July) and CVE-2026-93952 (September), both rated 10.0. Consequently, if your orchestrator missed those patches too, assume a wider window of risk.

Am I affected by the VeloCloud vulnerability?

Only on-premises VCO needs action from you. Arista lists VeloCloud Edges and Gateways as not affected by this advisory.

Arista did not assess end-of-support releases. Also, the 7.0 train appears in earlier VCO advisories but not in this one, so we cannot say whether it is affected. If you run 7.0, confirm with Arista support rather than guessing.

Arista’s advisory gives no command for checking the version. The simplest route is the operator portal, which shows the running release, or your own change records. Compare the full four-part number, for example 6.4.2.11, against the table above.

Next, check whether the web interface is reachable from the internet. Run this from a machine outside your network, replacing the hostname:

curl -sk -o /dev/null -w '%{http_code}\n' --max-time 10 https://vco.example.com/

Any HTTP status code (such as 200 or 302) means the portal answers from that location. A timeout is what you want from untrusted networks.

How to fix the VeloCloud vulnerability

First, back up the orchestrator and preserve logs (see the next section). Then follow these steps:

1. Upgrade to the fixed release on your train: 5.2.3.18, 6.1.3.10 or 6.4.2.12. If you are on an older or unsupported train, open a case with Arista TAC for an upgrade path.
2. Restrict the web interface to trusted admin networks at your firewall or VPN. Remember that edges also talk to the orchestrator, so test changes in a maintenance window.
3. Block 74.82.197.86 and 38.54.50.151 at the perimeter.
4. Limit outbound traffic from the VCO host to what it needs. Arista specifically suggests blocking unneeded outbound ports.
5. Audit portal users. Remove stale tenant accounts, enforce strong passwords and turn on two-factor authentication where your release supports it.
6. Revoke and reissue API tokens, because an attacker with operator rights could have created new ones.

If you cannot patch today, steps 2 to 4 are the only mitigations Arista offers. There is no configuration switch that closes the hole.

Check whether you were already compromised

Patching closes the VeloCloud vulnerability, but it does not remove access an attacker already gained. Arista asks customers to preserve evidence before remediation. That means VCO web access logs, backend application logs, system logs, database logs and file timestamps. Copy them off the box first.

The advisory does not name a log path, so set LOGDIR to wherever your VCO web access logs live. The script below only reads files. We tested it with bash -n, ShellCheck and a sample log.

#!/usr/bin/env bash
# Read-only search of VCO web access logs. Set LOGDIR to where your logs live.
LOGDIR="${LOGDIR:-/var/log/nginx}"

echo "== Hits from IPs published by Arista (advisory 0199) =="
zgrep -hE '74\.82\.197\.86|38\.54\.50\.151' "$LOGDIR"/*access* 2>/dev/null

echo "== Common SQL injection markers =="
zgrep -hiE "(%27|%22|union(%20|\+| )+select|sleep\(|benchmark\(|pg_sleep|information_schema|%2d%2d|--%20)" "$LOGDIR"/*access* 2>/dev/null | head -n 50

echo "== References to local or internal addresses =="
zgrep -hiE "(127\.0\.0\.1|localhost|169\.254\.|%2f%2f127|0\.0\.0\.0)" "$LOGDIR"/*access* 2>/dev/null | head -n 50

Only the two IP addresses are official IOCs. The other patterns follow Arista’s general advice to look for encoded characters, URL-like paths, references to internal services and high request rates. Expect some false positives, so review hits by hand. To spot unusual request rates, count requests per source address:

awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20

On the VCO host, also look for unexpected outbound connections and processes:

ss -tnp state established
ps -eo pid,user,lstart,cmd --sort=start_time | tail -30

Arista additionally tells customers to watch for backdoor daemons, web shells and unexpected admin changes. In the portal, review recent operator and enterprise activity for new users, role changes and new API tokens.

Finally, check the edges. The July advisory warned that attackers could reach managed edges through a compromised orchestrator. So compare current edge configurations, firewall rules and business policies against your last known-good backup. If anything changed without a ticket, rotate edge and orchestrator credentials and escalate it as an incident.

The other KEV entry: Collabora Online

CISA’s update that listed the VeloCloud vulnerability also added CVE-2026-110447, a command injection bug in Collabora Online’s built-in CODE server (richdocumentscode) used with Nextcloud. The Hacker News rates it 9.2 and says version 26.4.303 fixes it. Attackers have used it to plant web shells on Nextcloud servers. We cover detection and clean-up in our Nextcloud and Collabora web shell guide.

India angle

As of 26 October, we found no CERT-In advisory for this VeloCloud vulnerability. We also could not find a reliable public figure for how many Indian firms run on-premises VCO, so we will not guess.

Still, the reporting rules apply if you find compromise. Entities covered by CERT-In’s April 2022 Directions must report qualifying incidents within six hours. Meanwhile, if the orchestrator or the networks behind it held personal data, plan for the DPDP Rules too. Rule 7 (breach notice, with a detailed report to the Data Protection Board within 72 hours) applies from May 2027, but your contracts may already require prompt notice. MSPs running a shared orchestrator should also tell affected clients quickly, because one breached VCO can reach many customer sites.

Quick checklist

• ☐ Confirm whether you use hosted or on-premises VCO
• ☐ Record the exact on-prem release number
• ☐ Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later; ask TAC about 7.0
• ☐ Restrict the VCO web interface to trusted admin networks
• ☐ Block 74.82.197.86 and 38.54.50.151
• ☐ Preserve web, application, system and database logs
• ☐ Search logs for the IPs and injection-style requests
• ☐ Review portal users, roles and API tokens; revoke what you don’t recognise
• ☐ Compare edge configurations with a known-good backup
• ☐ Rotate orchestrator and edge credentials if anything looks wrong
• ☐ Decide on CERT-In and DPDP reporting if compromise is confirmed

Network management servers rarely get the same scrutiny as public websites, yet a single VeloCloud vulnerability can hand an attacker every branch. If you want an outside view of what your management interfaces expose, our VAPT services cover that. For the underlying Linux hosts, our Linux server hardening audit is a good next step.

Sources

• Arista Security Advisory 0199 (CVE-2026-114625)
• Arista security advisories index
• The Hacker News: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
• cvefeed.io: CVE-2026-114625 record with KEV dates
• CSO Online: On-prem VeloCloud Orchestrator under attack (CVE-2026-93952)
• The Register: VeloCloud CVE-2026-16812 exploited (July 2026)
• The Register: Arista acquires VeloCloud from Broadcom (July 2025)
• Senserva: Exploited this week

Need help with network security? We test routers, firewalls, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.