Arista published Security Advisory 0199 on Oct 22, 2026 for an actively exploited flaw in on-prem VeloCloud Orchestrator (VCO), the SD-WAN management portal.
• CVE-2026-114625: SQL injection, CVSS 3.1 score 9.9 (critical)
• Any authenticated user, down to the lowest Enterprise Read Only tenant role, can gain operator privileges as a local "superuser operator"
• Exposed by default; no configuration prevents it
• Arista detected the flaw and says it is known to be actively exploited
• Hosted and Dedicated VCO already patched; on-prem fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12
• Attack IPs observed: 74.82.197.86 and 38.54.50.151
This is Arista's fourth exploited VCO/EOS zero-day this year. A single stolen read-only tenant login is enough, so on-prem operators should patch now, restrict the VCO web UI to admin networks, and hunt logs for the listed IPs. Preserve logs before remediation if compromise is suspected.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
