Arista has disclosed that attackers are exploiting CVE-2026-114625, a SQL injection flaw in VeloCloud Orchestrator On-Prem that lets any authenticated user take operator privileges.
Arista published Security Advisory 0199 on Oct. 22. The advisory scores the flaw 9.9 under CVSS v3.1 and 9.4 under v4.0, and says it is known to be actively exploited. Affected are VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12. Hosted and Dedicated orchestrators were affected and are already patched. Arista says a release that is not on its list is not vulnerable, and that it has not assessed end-of-support versions. VeloCloud Gateway and Edge are not affected.
The attacker needs network access to the orchestrator’s web interface and a valid session. The lowest built-in tenant role, Enterprise Read Only, is enough. Arista states that VCO is exposed by default and that no configuration prevents the exposure. A read-only login at any customer or partner account therefore becomes a path to operator control of the orchestrator and the data it manages.
Arista recommends upgrading as soon as possible. Until then it advises limiting access to the web interface to trusted administrative networks, watching for traffic from 74.82.197[.]86 and 38.54.50[.]151, and watching outbound traffic from the VCO host for anything normal operation does not need. It also lists backdoor daemons, webshells and unexpected administrator changes as things to look for. If compromise is suspected, Arista asks teams to preserve the web access, application, system and database logs and file-system timestamps before remediating.
In our reading, the useful question for network teams and the MSPs that run orchestrators for customers is who holds any login at all, because the lowest-privilege account now opens the whole console. Management planes for edge gear keep appearing in our reporting, among them the PAN-OS update for CVE-2026-0322 and the Cisco Secure Email Gateway exploitation. Inventory every VCO instance, confirm its release train against the three fixed versions, and review which accounts exist on it today.
