If you run an on-premises VeloCloud Orchestrator (VCO) for your SD-WAN, stop and check your version.
On 22 October 2026, Arista published advisory 0199 for CVE-2026-114625, a SQL injection with a CVSS score of 9.9. It is already being exploited, and CISA added it to the Known Exploited list on 23 October.
Why it is so serious
The orchestrator is the brain of the SD-WAN. Whoever controls it controls the edges and the routing for every site.
This bug needs a login, but any login is enough. The minimum role is Enterprise Read Only, the lowest customer role. From there, the attacker can reach operator privileges, which is the highest level of control on the orchestrator.
So the usual thinking, "it's only a read-only account, so the risk is low", doesn't apply here.
Am I affected?
- On-premises VCO: yes, unless you are on 5.2.3.18, 6.1.3.10, 6.4.2.12 or a later build in the same train.
- Hosted and dedicated VCO: Arista says they have already patched these.
- VeloCloud Gateways and Edges: not affected.
One more detail from The Hacker News: orchestrators that were patched for earlier VCO bugs this year are still affected by this one, because those builds came before this fix. Don't assume you are fine because you patched in September.
What to do
- Upgrade to the fixed build for your train.
- Limit access to the VCO web interface to trusted admin networks only.
- Block and search for the two IPs in Arista's advisory:
74.82.197.86and38.54.50.151. - Review web access logs for strange paths, encoded characters and bursts of requests, and review recent admin activity.
- Look for persistence: webshells, unknown daemons, unexpected outbound connections from the VCO host.
- Clean up accounts: remove read-only users nobody uses anymore. Every account is now a possible way in.
The advisory doesn't say whether upgrading removes access an attacker may already have. So if your VCO was exposed, preserve logs and timestamps first, then investigate before you call it done.
Personal view only. Always check Arista's advisory 0199 for the full details.
Comments
No comments yet. Share your own debugging war story.