Who this is for: network and security teams running Arista's SD-WAN management platform, VeloCloud Orchestrator (VCO), on their own infrastructure. This page is based on Arista's security advisories and CISA's public data. It does not cover how the attacks work.
Developing: this page will be updated as more is published
As of 03:45 UTC, October 24, 2026Not yet known
- When exploitation began, and who is behind it
- Why the 7.0 train is not listed, and 7.0 fixes for the July and September flaws
- Fixed releases for the September flaw (CVE-2026-93952) on the 6.1 train
- Advisories from Japanese public bodies (JPCERT/CC, IPA)
Arista published Security Advisory 0199 (revision 1.0) on October 22, and CISA added the flaw to KEV on October 23. Neither has said when exploitation began or who is behind it. Neither the advisory nor the KEV entry mentions public exploit code. This page will be updated when the advisory is revised.
What to do today (on-prem VCO)
Check your version and pick the target release
Check your VCO version and use the table below to choose the release to move to. The fixes for this flaw (5.2.3.18, 6.1.3.10, 6.4.2.12) are newer than the July and September fixes. You need to upgrade again even if you applied those.
Preserve logs and file timestamps before upgrading
If compromise is suspected, Arista asks operators to preserve VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediation. Copy them somewhere else before an upgrade or rebuild overwrites them.
Upgrade to the fixed release
Move to the latest fixed release on your train. This advisory says releases that are not listed are not vulnerable, and 7.0 is not listed. Because no 7.0 fixes are listed for the July and September flaws either, confirm with Arista TAC (Technical Assistance Center) — this is our recommendation, not the advisory’s. End-of-support versions have not been assessed.
Restrict who can reach the management interface
Arista says VCO is exposed by default and that no configuration can prevent the exposure. Use the firewall in front of VCO to limit access to the web interface to trusted administrative networks. Before you tighten it, confirm which connections operations depend on, such as VeloCloud Edge devices connecting to VCO.
Check for signs of compromise
Work through the checks in the section below. Arista has not said when exploitation began, so go back as far as your retained logs allow. The advisory also lists source addresses seen in the attacks. Open Arista's advisory and compare that list against your own logs.
Review user accounts
This flaw can be exploited with the lowest built-in tenant role, Enterprise Read Only. Disable unused accounts, accounts belonging to former staff or contractors, and shared accounts, and review the passwords of the accounts you keep.
Fixed releases by train (three advisories side by side)
Each advisory names its own fixed releases. To pick one target per train, this site lined up Arista's three advisories.
| Train | July: CVE-2026-16812 (SA-0144) | September: CVE-2026-93952 (SA-0183) | October: CVE-2026-114625 (SA-0199) | Target |
|---|---|---|---|---|
| 5.2 | Fixed in 5.2.3.14 and later | Fixed in 5.2.3.16 and later | Fixed in 5.2.3.18 and later | 5.2.3.18 or later |
| 6.1 | Fixed in 6.1.3.4 and later | Affected: 6.1.3.7 and below. No 6.1 fix listed | Fixed in 6.1.3.10 and later | 6.1.3.10 or later (confirm the September flaw with Arista TAC) |
| 6.4 | Fixed in 6.4.2.4 and later | Fixed in 6.4.2.8 and later | Fixed in 6.4.2.12 and later | 6.4.2.12 or later |
| 7.0 | Affected: before 7.0.0.1. No 7.0 fix listed | Affected: 7.0.0.2 and below. No 7.0 fix listed | Not listed (the advisory says unlisted releases are not vulnerable) | Confirm with Arista TAC (no 7.0 fixes listed for July or September) |
| End of support | Not assessed | Contact TAC | Not assessed | Confirm with Arista TAC |
The September advisory (SA-0183) says fixes for other trains "will be added over time" (revision 1.1, checked on October 24).
July SA-0144
Fixed in 5.2.3.14
September SA-0183
Fixed in 5.2.3.16
October SA-0199
Fixed in 5.2.3.18 (go here)
What Arista disclosed
- CVE
- CVE-2026-114625
- Type
- SQL injection (CWE-89)
- Severity
- CVSS v4.0 9.4, v3.1 9.9 (Arista's scores, which NVD also lists)
- Impact
- Any authenticated user can gain operator privileges and masquerade as a local "superuser operator". This reaches internal-only functionality remotely and may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages
- Requirements
- Network access to the VCO web interface and a valid authenticated session. The minimum role is Enterprise Read Only, the lowest built-in tenant role. VCO is exposed by default and no configuration prevents the exposure
- Affected
- VeloCloud Orchestrator On-Prem: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12. The 7.0 train is not listed; the advisory says unlisted releases are not vulnerable. End-of-support versions have not been assessed
- Not affected
- VeloCloud Edge, VeloCloud Gateway, EOS-based Arista products and others
- Hosted
- Hosted VCO, including Dedicated, was affected and has already been patched
- Exploitation
- Detected by Arista and "known to be actively exploited"
CISA added CVE-2026-114625 to KEV on October 23 and set October 26 as the due date for US federal agencies. The KEV entry marks it as requiring forensic triage. Known ransomware use is listed as "Unknown".
Three exploited flaws in three months
July 27, 2026
Arista discloses CVE-2026-16812 (OS command injection, CVSS 10.0) in SA-0144. No login needed. Discovered externally and known to be exploited. CISA adds it to KEV the same day (due July 30).August 3
SA-0144 revised to add Hosted VCO to the affected platforms.September 22
Arista discloses CVE-2026-93952 (improper input validation, CVSS v3.1 10.0, v4.0 9.5) in SA-0183. No login needed. Applies where certificate-based authentication from VeloCloud Edge to VCO is configured. Discovered externally and known to be exploited. CISA adds it to KEV the same day (due September 25).October 22
Arista discloses CVE-2026-114625 (SQL injection, CVSS v4.0 9.4) in SA-0199, detected by Arista itself and known to be exploited.October 23
CISA adds it to KEV (due October 26).
The July and September flaws need no login; the October flaw does. The bug types differ, but all three advisories describe the same outcome: remote access to internal-only functionality that can impact the VCO host. All three list interim controls in common, such as restricting the web interface to administrative networks.
How to check for compromise (from the advisories)
Keep the evidence before you fix
Arista asks operators who suspect compromise to preserve VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediation, where operationally feasible. Upgrading or rebuilding first destroys what you need to investigate.
| Where to look | What to check (from the advisory) |
|---|---|
| Web access logs | Unusual URL-like path components, encoded characters, references to local or internal services, high request rates |
| Source addresses | Connections from the attack sources listed in the advisory (check the list in Arista's advisory) |
| Outbound traffic from VCO | Unexpected outbound connections. Consider blocking outbound ports not needed for normal operation |
| On the host | Backdoor daemons and webshells |
| Administrator activity | Recent changes nobody on your team made |
The July (SA-0144) and September (SA-0183) advisories add more: sensitive configuration changes that don't match administrator work; unexpected command execution, file creation, database exports or archives; and unexpected access to database contents, configuration, device inventory, credentials, certificates or keys. SA-0183 also lists specific file and log artefacts. If you find them, Arista asks you to preserve the VCO's state and contact Arista TAC.
If you find a compromise
The July and September advisories list post-remediation steps. They warn that a compromised VCO may also give attackers access to VeloCloud Edge devices.
- Rotate credentials
- Review administrator activity
- Validate the state of managed devices (Edges)
- Restore or replace the orchestrator from trusted sources
This site's view: keep management planes off the internet
VCO is where the configuration of every branch's SD-WAN devices is managed. Arista's own advisories say a compromised VCO may expose the Edge devices it manages.
All three advisories require network access to the VCO web interface. Two of them, July and October, say VCO is exposed by default and that no configuration prevents the exposure. Unless the operator restricts access at the network layer, the next flaw will start from the same exposed position. At a rate of three in three months, waiting for each fix is not enough on its own.
Practices that leave you exposed to the next flaw
- The management interface can be reached from anywhere on the internet
- Work stops once the patch is applied
- Read-only accounts are left alone because they "can't do anything"
- Outbound traffic from VCO is unrestricted
Practices that limit the next flaw
- The management interface is reachable only from an admin network or VPN
- Logs are preserved and reviewed for signs of compromise at every upgrade
- Accounts are reviewed regularly and unused ones are disabled
- Outbound traffic from VCO is limited to destinations operations need
The same pattern keeps repeating with VPN and firewall management interfaces. For how to find and protect internet-facing management interfaces, see remote access defense for VPN appliances. For why KEV listings move to the top of the queue, see deciding what to patch first with CVSS, EPSS and KEV.
What is still unknown
| Item | Status |
|---|---|
| Active exploitation | Confirmed (Arista, CISA) |
| When exploitation began, and who is behind it | Not stated |
| Number of affected organisations | Not stated |
| Public exploit code | Not stated (advisory and KEV) |
| Why the 7.0 train is not listed | Not stated (the advisory says unlisted releases are not vulnerable) |
| 6.1 and 7.0 fixes for the September flaw | Not listed ("will be added over time") |
| Japanese public advisories | As of October 24, no JPCERT/CC or IPA alert found |
No list of organisations using VCO has been published, and this site does not guess at specific users.
Sources
- Arista, "Security Advisory 0199" (CVE-2026-114625, October 22, 2026, revision 1.0) — arista.com
- Arista, "Security Advisory 0183" (CVE-2026-93952, September 22, 2026, revision 1.1) — arista.com
- Arista, "Security Advisory 0144" (CVE-2026-16812, July 27, 2026, revision 1.2) — arista.com
- CISA, "Known Exploited Vulnerabilities Catalog" (CVE-2026-114625) — cisa.gov
- NVD, "CVE-2026-114625" — nvd.nist.gov
Update history
2026-10-24: First published, based on Arista's three advisories (SA-0144, SA-0183, SA-0199) and CISA's KEV catalog.
Read next
- Protecting internet-facing devices: Remote access defense for VPN appliances
- Prioritising: Deciding what to patch first with CVSS, EPSS and KEV
- Checking for compromise: How to check if your server was hacked
- Another urgent flaw the same week: PHP CVE-2026-109618 and CVE-2026-109619
- Terms: What is SQL injection? / What is CVSS?