Security notice
Run your own VeloCloud Orchestrator? Attackers are using this flaw. Update today.
On October 22, 2026, Arista released fixes for CVE-2026-114625, a flaw in VeloCloud Orchestrator On-Prem, the software that manages VeloCloud SD-WAN networks linking offices and branches. Arista rates it 9.9 out of 10 and says it is known to be actively exploited. Anyone with a login to the orchestrator, even the lowest read only role, can gain full "superuser operator" control. Most small business owners do not run this software themselves. If an IT provider or MSP runs your office or branch network, ask them today whether they run an on-premises VeloCloud Orchestrator and whether it is on a fixed version. Arista says the hosted versions it runs are already patched.
Update, October 24, 2026
The US government now lists this flaw as exploited. If anyone runs a VeloCloud Orchestrator for your business, the advice is the same: update it today and check it for signs of a break in.
- Now on CISA's list. On October 23, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog, "based on evidence of active exploitation." (CISA alert, CISA KEV)
- Federal deadline: October 26. The catalog gives US federal civilian agencies until Monday, October 26, 2026 to act on it. That deadline is only binding on those agencies, but CISA encourages every organization to put flaws on this list first. (CISA KEV, CISA alert)
- Patching is not the whole job. CISA marks this entry for forensic triage. Under CISA's rules for federal agencies, that means checking whether attackers got in before the fix was applied. Step 4 below lists the signs Arista says to look for. (CISA KEV, CISA alert)
Nothing else has changed. Arista's advisory still lists the same affected and fixed versions: 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later for each line. EverThread does not test for this flaw and cannot see your orchestrator, so only whoever runs it can confirm its version and check its logs. (Arista)
What happened
VeloCloud SD-WAN connects a business's offices, shops or branches over the internet. The VeloCloud Orchestrator, or VCO, is the web portal used to set up and manage that network and its edge devices. Some organizations and IT providers run their own copy of the orchestrator, called VCO On-Prem. Only those copies need action. (Arista)
- The flaw. Arista says it is an SQL injection flaw that lets any logged in user gain operator privileges and act as a local "superuser operator", including functions meant for internal use only. Arista says attacks could compromise the orchestrator and the data it manages. (Arista)
- How bad. Arista scores it 9.9 out of 10 (CVSS 3.1, critical). (Arista)
- Being exploited. Arista says it detected the issue itself and that it is known to be actively exploited. Arista lists two attacker IP addresses it has seen. (Arista, BleepingComputer)
- Low bar. The attacker needs network access to the orchestrator's web interface and any valid login. The lowest built in role, Enterprise Read Only, is enough. Arista says the orchestrator is exposed by default and no setting prevents the exposure. (Arista)
- Not the first this year. In September, Arista fixed a different exploited flaw in on-premises VeloCloud Orchestrator, CVE-2026-93952. Being patched for that one does not cover this one. (CISA, BleepingComputer)
Who should worry
This is not a problem with your website or online store, and your site visitors are not at risk from it. It is about the system that manages your office or branch network, and most small business owners will never run it themselves.
Ask about this if any of these are true:
- Your IT provider or MSP manages your office or branch network with VeloCloud SD-WAN.
- You are an IT provider or MSP and run a VeloCloud Orchestrator for your customers.
- Your business runs its own VeloCloud Orchestrator on its own servers.
If your VeloCloud service is hosted, check with your provider. Arista says the hosted versions of the orchestrator it runs, including Dedicated, were affected and have already been patched. If your provider runs its own on-premises orchestrator for you, that copy needs updating. (Arista)
VeloCloud Edge and VeloCloud Gateway devices are not affected, according to Arista. Only the orchestrator is. (Arista)
What to do now
Do these today.
- Ask the question. Send the message below to your IT provider, MSP or IT person. You need a clear yes or no: do you run an on-premises VeloCloud Orchestrator for us, and is it on a fixed version?
- Update every on-premises orchestrator to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later for its line. (Arista)
- If it is on an older line with no fix, Arista says to contact its support team (TAC) about upgrade options. Arista has not checked versions that are past end of support. (Arista)
- Check for signs of attack. Arista gives specific signs to look for, listed below.
- If the answer is "I don't know", that is not a no. Ask them to check.
What to send your IT provider, MSP or IT person
Arista released fixes on October 22, 2026 for CVE-2026-114625 (CVSS 9.9) in VeloCloud Orchestrator On-Prem. Arista says it is being actively exploited and lets any logged in user, even Enterprise Read Only, gain superuser operator control. Please confirm whether you run any on-premises VeloCloud Orchestrator for our business, and upgrade it today to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. Until then, please restrict its web interface to trusted admin networks, block 74.82.197.86 and 38.54.50.151, and review its logs and recent administrator changes as Arista's Security Advisory 0199 describes. Please tell us what you find. Source: Arista Security Advisory 0199.
Technical steps
Step 1. Check your version against Arista's list
Affected: VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12. If your release is not listed, Arista says it is not vulnerable, but end of support versions have not been assessed. (Arista)
Step 2. Install the fixed release
5.2 line: 5.2.3.18 or later. 6.1 line: 6.1.3.10 or later. 6.4 line: 6.4.2.12 or later. Not on a supported line: contact Arista TAC. (Arista)
Step 3. Until you can patch
Arista says no setting removes the exposure, but advises these controls until the fix is in:
- Restrict access to the orchestrator web interface to trusted admin networks.
- Block and watch for the attacker IP addresses 74.82.197.86 and 38.54.50.151.
- Watch for unexpected outbound traffic from the orchestrator host, and consider blocking outbound ports it does not need.
- Watch for backdoor programs and web shells.
- Review recent administrator activity for unexpected changes.
(Arista)
Step 4. Look for signs of attack
Review the orchestrator's web access logs for requests with unusual URL like path parts, encoded characters, references to local or internal services, or high request rates, and for the two IP addresses above. If you suspect a break in, Arista says to save the web access, application, system and database logs and file timestamps before fixing anything, where you can, and to contact Arista TAC. (Arista)
Common questions
Has my business been hacked?
This notice does not mean your business has been hacked. Arista says the flaw is being exploited, but it has not said who was targeted or how many systems. Only whoever runs your orchestrator can check its logs. (Arista)
Can EverThread tell me if I am affected?
No. EverThread checks websites from the outside, the way a browser sees them. We do not scan network management systems such as VeloCloud Orchestrator, so we cannot tell whether yours is on a fixed version or whether anyone has attacked it. Whoever runs your orchestrator can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.
Our VeloCloud service is hosted. Do we need to do anything?
Check with your provider. Arista says the hosted orchestrators it runs, including Dedicated, have already been patched. If your provider runs its own on-premises orchestrator for you, ask them to confirm it is on a fixed version. (Arista)
Is it on the US government's list of exploited flaws?
Yes. On October 23, 2026, CISA added it to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation, and gave US federal civilian agencies until October 26, 2026 to act. CISA also marked it for forensic triage, which means agencies are expected to check whether attackers got in before they patched. Those deadlines bind only federal agencies, but Arista says the flaw is being exploited, so update today and check the logs. (CISA alert, CISA KEV, Arista)
Where can I follow official updates?
Arista's Security Advisory 0199 has the official details and will show any revisions. (Arista)
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Arista: Security Advisory 0199, October 22, 2026
- BleepingComputer: Arista patches new VeloCloud Orchestrator zero-day exploited in attacks, October 22, 2026
- CISA: Known Exploited Vulnerabilities Catalog (CVE-2026-93952, added September 22, 2026; CVE-2026-114625, added October 23, 2026, due October 26, 2026; catalog version 2026.10.23, checked October 24, 2026)
- CISA: CISA Adds One Known Exploited Vulnerability to Catalog, October 23, 2026