Arista Networks has patched a critical flaw in the on-premises version of VeloCloud Orchestrator that attackers are already exploiting, the company said in a security advisory Thursday. The software is the control center for VeloCloud networks that link company branch offices, and it is the third exploited zero-day in the product in four months, SecurityWeek reported, a pattern that turns a routine patch into a question about vendor risk.
A zero-day is a flaw attackers use before the vendor has a fix available or before most customers have applied one.
What Happened
Arista's Security Advisory 0199 describes CVE-2026-114625, a SQL injection flaw, meaning an attacker can slip database commands into input the software fails to check. Arista rates it 9.9 out of 10 under the CVSS 3.1 scoring system and 9.4 under the newer CVSS 4.0.
The attacker needs a valid login, but not much of one. According to the advisory, any authenticated user, including one holding the Enterprise Read Only role, the lowest built-in tenant role, can gain operator privileges and pose as a local "superuser operator," reaching functions meant to be internal only. Arista says the orchestrator's web interface is exposed by default and that no configuration setting prevents that exposure.
Arista said it detected the problem itself and that it is known to be actively exploited. It listed two IP addresses seen in the attacks, 74.82.197.86 and 38.54.50.151, and told customers to block them and search their logs for past contact.
Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later in their respective release trains. Arista said its hosted and dedicated orchestrator instances were also affected and have already been patched. It did not assess versions that are past end of support; customers on those should contact Arista's technical support.
Until they can upgrade, the advisory tells customers to restrict the web interface to trusted administrative networks, watch for unexpected outbound traffic from the server, look for backdoor programs and web shells (small scripts that give intruders remote control) and review recent administrator changes. If compromise is suspected, Arista asks them to preserve web, application, system and database logs and file timestamps before cleaning up.
Why It Matters
BleepingComputer describes the orchestrator as the central platform for managing VeloCloud SD-WANs, or software-defined wide-area networks, and their edge devices. Because one console configures equipment across many sites, control of it is worth far more to an intruder than a single server, and a break-in there may not stay contained.
The low bar for exploitation also matters for governance. Read-only accounts are often handed to auditors, contractors or managed service providers with little scrutiny. Under this flaw, any of those logins is enough.
The repetition is the larger signal for boards. SecurityWeek counted this as the third exploited VeloCloud Orchestrator zero-day in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September. BleepingComputer reported that Arista has now patched four actively exploited zero-days in 2026, counting CVE-2026-7473 in its EOS switch software in May. Organizations that depend on the product should ask whether the management console is reachable only from networks they control and whether it is being monitored as a likely target.
Context
The advisory says the product was formerly sold as VeloCloud Orchestrator by Broadcom. Neither Arista nor the outlets covering the flaw have named who is behind the attacks or said how many customers were hit.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the September flaw, CVE-2026-93952, to its Known Exploited Vulnerabilities catalog on Sept. 22 and gave federal civilian agencies until Sept. 25 to act.
What to Watch
A CISA listing would set a binding patch deadline for federal civilian agencies and usually prompts wider attention from private-sector security teams. Also watch for any attribution of the attacks, victim counts, or follow-up findings from Arista or outside researchers about what intruders did once inside, which would tell customers how deep a post-patch investigation needs to go.
