Arista patches an exploited flaw that turns a read-only observer into a network admin

The console's most modest role, the one that only lets you look, would have been enough. On October 22, Arista published an advisory on a flaw in its VeloCloud orchestrator: any logged-in user, even with simple read-only access, can obtain operator rights and impersonate the local "super operator." The vendor says the flaw, CVE-2026-114625, is being actively exploited.

VeloCloud Orchestrator (VCO) is the web portal that manages a company's SD-WAN networks, meaning the links that connect its sites and branch offices to each other and to the internet. Whoever takes control of it holds a central position in the network. Arista rates the severity at 9.9 out of 10 (CVSS 3.1).

Who is affected?

Only on-premises ("On-Prem") installations need patching. The versions hosted by Arista, including dedicated ones, were affected but have already been fixed: their customers have nothing to do.

For everyone else, the attack conditions are minimal: network access to the web interface and a valid session with the "Enterprise Read Only" role, the lowest of the available roles. The advisory classifies the flaw as an SQL injection, without detailing the link to the privilege escalation described. It also states that no setting can eliminate the risk. Arista says it detected the problem itself. It does not say how long the attacks have been going on, or who is behind them.

A fourth exploited flaw this year

This is not a first. According to BleepingComputer, Arista has already patched three other flaws in 2026 that were exploited before any fix was available, two of them in this same orchestrator. In July, the flaw CVE-2026-16812, rated 10 out of 10, allowed command injection without even being logged in. CISA, the US cybersecurity agency, added it on July 27 to its catalog of exploited vulnerabilities. VeloCloud, a former VMware product, went to Arista after it was acquired from Broadcom.

What to do

A network administration console reachable with a viewing account: this is often the kind of access that gets handed out widely, to contractors or monitoring teams.

• Update to VCO 5.2.3.18, 6.1.3.10 or 6.4.2.12, or a later version. For branches that are no longer maintained, Arista refers customers to its technical support.
• Restrict access to the web interface to trusted administration networks only.
• Block and hunt for the two addresses seen in the attacks: 74.82.197.86 and 38.54.50.151.
• Review the web logs: unusual URL paths, encoded characters, references to local or internal services, bursts of requests. Also watch for unexpected outbound connections, webshells and recent changes made by administrators.
• If in doubt, preserve the logs (web, application, system, database) and file timestamps before any remediation.

The question remains who is targeting this console with such regularity: this is the third exploited flaw in VCO since July, and the vendor has yet to name any attacker.