Zero Radar
← feed
CriticalVulnerabilityCVE-2026-114625updated 26 Oct 2026, 13:16 UTC

Arista VeloCloud Orchestrator on-prem: any logged-in user can become operator

Anyone with a login to the VeloCloud management server, even a read-only customer account, can gain top-level control over it. Attackers are already using this flaw.

Exploited (CISA KEV, NVD)Fix availableOfficial, 7 sources
SeverityCriticalCVSS 9.4 of 10
Being exploited?YesConfirmed by CISA KEV, NVD · 23 Oct 2026
Fix available?YesArista has released security updates for on-prem VCO. Specific fixed version numbers: unknown (check the Arista advisory). · since 25 Oct 2026
How sure is this?Official, 7 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker with loginAny valid account, even read-only
  2. 2SQL injectionMalicious input reaches the database query
  3. 3Operator privilegesMasquerades as local superuser operator
  4. 4Internal functionsReaches features meant only for internal use
  5. 5Orchestrator compromisedManaged network and data at risk
  6. ResultAttacker controls the orchestrator

What happened

A SQL injection flaw in Arista VeloCloud Orchestrator (VCO) on-prem lets an authenticated remote user reach internal-only functions and masquerade as the local superuser operator.

Why it is dangerous: A compromised orchestrator can expose or change the confidentiality, integrity and availability of the SD-WAN network and data it manages. Organisations running on-prem VCO with customer-level accounts are at risk.

Are you affected?

You are affected if you run an on-prem VeloCloud Orchestrator (VCO) instance with any authenticated user accounts, including read-only customer accounts.

Arista VeloCloud Orchestrator (VCO) on-prem deployments. Hosted (including Dedicated) VCO versions were impacted but have already been patched. Exact affected version numbers: unknown.

What to do

  1. Apply the Arista security update for on-prem VeloCloud Orchestrator immediately
  2. If patching is not possible at once, restrict remote access to the VCO and limit or remove customer-level logins
  3. Review VCO logs and check for signs of compromise, including unexpected operator-level activity, before and after patching
  4. Follow CISA BOD 26-04 forensic triage guidance if you are a US federal agency

Timeline

  1. 22 Oct 2026, 17:18 UTC
    Publicly disclosed
  2. 22 Oct 2026, 17:18 UTC
    Reported by BleepingComputer · BleepingComputer
  3. 22 Oct 2026, 19:05 UTC
    Reported by The Hacker News · The Hacker News
  4. 22 Oct 2026, 21:17 UTC
    Reported by NVD · NVD
  5. 23 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  6. 23 Oct 2026, 09:58 UTC
    Reported by SecurityWeek · SecurityWeek
  7. 25 Oct 2026, 15:20 UTC
    CISA reported on it · CISA
  8. 25 Oct 2026, 15:20 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)

Sources 7 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Technical details

ID
CVE-2026-114625 · ZR-94808457 · ZR-23872cb1 · ZR-5d4f96d6
CVSS
9.4 / 10
EPSS
1.0% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 17:18 UTC
On Zero Radar
before the radar started
Last change
26 Oct 2026, 13:16 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Arista VeloCloud Orchestrator on-prem: any logged-in user can become operator · Zero Radar