A critical, actively exploited flaw in Arista's VeloCloud Orchestrator on-prem software has pushed the vendor to its fourth emergency SD-WAN patch of the year. For UK operators running VCO in-house, this is no longer a routine update — it's an active incident response window.
View the data behind this chart
| Phase | Starts (week) | Duration (weeks) |
|---|---|---|
| CVE-2026-7473 (May) | 18 | 4 |
| CVE-2026-16812 (Jul) | 27 | 4 |
| CVE-2026-93952 (Sep) | 36 | 4 |
| CVE-2026-114625 (Oct) | 42 | 2 |
What Arista disclosed
Arista Networks has released fixes for CVE-2026-114625, a critical-severity SQL injection flaw in VeloCloud Orchestrator (VCO) On-Prem deployments, according to BleepingComputer. VCO is the web-based control plane administrators use to configure and monitor VeloCloud SD-WAN fabrics and their connected edge devices.
Arista confirmed the bug lets any authenticated user with basic access to the VCO web interface escalate to operator privileges and effectively masquerade as a local 'superuser operator' — reaching internal functionality that was never meant to be remotely reachable. The attack requires no user interaction and is rated low complexity, which is precisely why it has already been weaponised in the wild.
Patched versions and current status
As of today, Arista has shipped fixes across its three live VCO branches: 5.2.3.18 and later, 6.1.3.10 and later, and 6.4.2.12 and later for hosted deployments, per BleepingComputer's reporting. Anything running an on-prem VCO build below these thresholds should be treated as exposed until confirmed otherwise.
Arista also published two indicators of compromise tied to ongoing attacks — the IP addresses 74.82.197.86 and 38.54.50.151 — and urged teams to block them immediately while patching proceeds.
Why this is the third VCO zero-day since May
This is not an isolated incident. This is the fourth actively exploited zero-day affecting Arista's VeloCloud Orchestrator or Extensible Operating System this year, following CVE-2026-7473 in May, CVE-2026-16812 in July and CVE-2026-93952 in September, per BleepingComputer. SecurityWeek also reported on this as the third VeloCloud Orchestrator zero-day exploited in four months, referring to the current incident as the third in a recent series.
That cadence matters more than any single CVE score. Attackers appear to have identified SD-WAN orchestration consoles as a durable, repeatable entry point — likely because a single compromised VCO instance can expose configuration data and management access across an entire branch network. For UK buyers evaluating Arista products and solutions, the pattern itself is now a procurement and risk-management signal, not just a patching footnote.
What UK network operators should do now
Arista's guidance, as relayed by BleepingComputer, is unambiguous: patch first, then clean up. Until updates are fully deployed, the vendor recommends restricting VCO web interface access to administrative networks only, monitoring for connections from the published malicious IPs, and reviewing recent administrator activity for unexplained changes.
Teams should also scrutinise VCO web access logs for unusual URL-like path components, encoded characters, references to internal services, or abnormally high request rates — all signs flagged by Arista as exploitation indicators. If compromise is suspected, the company advises preserving web access logs, backend application logs, system logs, database logs and file-system timestamps before remediation, and engaging Arista's Technical Assistance Center directly.
- •Confirm VCO on-prem builds meet or exceed 5.2.3.18, 6.1.3.10 or 6.4.2.12
- •Block 74.82.197.86 and 38.54.50.151 at the perimeter
- •Restrict VCO web interface access to admin-only network segments
- •Audit logs for unusual paths, encoded characters and high request rates before and after patching
The wider SD-WAN exposure problem
Four exploited zero-days in one orchestration platform within five months should reframe how UK infrastructure teams think about SD-WAN risk generally. Orchestrators sit at the centre of distributed branch networks, which is exactly why they're attractive to attackers and why understanding what is SD-WAN and its management-plane exposure matters at board level, not just in the NOC.
Organisations weighing their next SD-WAN refresh, or reconsidering vendor concentration risk after this run of disclosures, may find it useful to compare SD-WAN vendors on patch cadence and exposed-management-plane history, not just throughput and licensing cost.
Building resilience beyond the next patch
Repeated critical-severity disclosures on the same platform argue for a structural response, not just a patch cycle. That means embedding vulnerability management strategies that track vendor advisories in real time, understanding CVE and CVSS scores well enough to triage genuine emergencies from routine updates, and layering network security solutions around management interfaces that shouldn't be internet-facing in the first place.
For estates running ageing or unsupported VCO hardware, third-party maintenance for networking can help bridge support gaps while a refresh is planned, but it doesn't substitute for applying vendor security patches the moment they land.