Arista patches actively exploited VeloCloud Orchestrator zero-day

Arista Networks released security updates on Oct. 22, 2026 to patch an actively exploited zero-day vulnerability in VeloCloud Orchestrator on-premises deployments, tracked as CVE-2026-114625.

VeloCloud Orchestrator is a web-based management portal for configuring, monitoring and managing VeloCloud SD-WAN (software-defined wide-area network) and its associated edge devices. The flaw lets attackers holding basic privileges and an authenticated session escalate to operator-level access through SQL injection, reaching internal-only functionality never intended for remote use. The attack needs only access to the VCO web interface and requires no user interaction. Arista says the vulnerability poses a critical risk to the confidentiality, integrity and availability of the orchestrator and the data it manages.

Breaching the orchestrator grants attackers full control over connected VeloCloud Edge devices, opening a path to network-wide compromise through lateral movement. Security outlets describe VCO as a Tier-0 asset for that reason, placing it among the infrastructure that needs urgent patching and restricted exposure.

Arista acquired VeloCloud from Broadcom in 2025, inheriting an orchestration layer that had previously passed from VMware to Broadcom. The vulnerabilities trace to internal functions that developers assumed were trustworthy, but poor input sanitization and unintended remote accessibility left them exposed on the network. With high privilege over downstream devices, the platform is a prime attack target.

This year has followed a pattern. Arista has patched three other actively exploited zero-day flaws affecting Extensible Operating System (EOS), its network operating system, and on-premises VCO deployments: CVE-2026-7473 in May, CVE-2026-16812 in July, and CVE-2026-93952 in September.

CVE-2026-16812, a critical flaw in VCO On-Prem disclosed Nov. 18, 2025, lets remote attackers reach privileged internal functionality without any authentication, needing only network access to the VCO web interface and exposing the host by default. No configuration can block the exposure, and the flaw was discovered externally after the acquisition rather than during due diligence. Industry experts describe it as a CISO day wrecker, an unauthenticated command-injection bug already exploited in the wild with no configuration workaround that compromises the entire SD-WAN network including its edge devices. Arista patched VCO versions 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1, and recommended blocking traffic from 8.19.75.217, 206.72.242.124 and 206.72.242.162.

CVE-2026-93952, disclosed Sept. 22, carries a CVSS score of 10.0, the maximum severity rating, and is confirmed to be actively exploited. It lets remote attackers with no login access escalate privileges wherever certificate-based authentication is enabled between VeloCloud Edge and VCO; setups relying on pre-shared keys are not exposed. Arista has not disclosed when the exploitation began or how widespread it is.

Cloud-hosted VCO deployments are already patched, specifically versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later. On-premises customers remain exposed until they install their own updates. Arista secured its hosted environments before on-premises ones, a sequencing decision that delays fixes for organizations prioritizing compliance, data sovereignty or direct control over their infrastructure. Many enterprises leave VCO management interfaces internet-accessible, which worsens exposure.

Patching can also create operational problems. Arista warns that updates may disrupt SD-WAN automation workflows built with tools such as Ansible and Terraform because the changes affect backend command execution, so teams should test patches carefully before deployment.

If compromise is suspected, Arista recommends preserving web access, backend, system and database logs along with file-system timestamps before any remediation work begins. The vendor’s incident-response guidance also covers credential rotation, reviews of administrator activity and validation of device state.

Signs of intrusion include files such as /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond — registered under MD5 hash dc78e206eaeadec59fc5801fe4556bd0 — and /etc/systemd/system/vc-sysmon.service. Defenders should also watch for the x-vc-opt HTTP header and connections to 142.93.149.77 and 104.248.126.159. Detecting these indicators requires log monitoring and reviews of suspicious activity.

Because VCO centrally manages SD-WAN configurations, an intruder with operator access could change how traffic moves across the network rather than observe it. Until on-premises customers apply the October updates, their VCO instances remain vulnerable.