VeloCloud Zero-Day: Patch Your Orchestrator Before It Patches You

Arista has confirmed active exploitation of a critical flaw in its VeloCloud Orchestrator — the system that manages SD-WAN networks for businesses and managed service providers. If you run VeloCloud on-premises, this one deserves attention this week.

What happened

The flaw (CVE-2026-114625, rated 9.9 out of 10) is a SQL injection in the on-premises VeloCloud Orchestrator. Any authenticated user — even one with read-only access — can escalate to the local superuser operator account. No admin interaction required.

This is the third actively exploited VeloCloud Orchestrator flaw since July 2026, and there's a trap: the builds that fixed July's and September's flaws are vulnerable to this one again. Patching in September does not cover you.

What to do

• Update to a fixed build: 5.2.3.18, 6.1.3.10, or 6.4.2.12, depending on your line.
• Hosted or dedicated VeloCloud customers are already patched by Arista — no action needed.
• If you manage VeloCloud for clients, check every on-prem orchestrator in your fleet, and hunt or block these exploit source IPs: 74.82.197.86 and 38.54.50.151.
• Now in CISA's exploited list (KEV) — added Oct 23, with a federal remediation deadline of Oct 26 — on top of Arista's confirmation of active exploitation.

Why it matters

SD-WAN orchestrators sit at the centre of a business's network — they decide how traffic flows between offices, data centres, and the cloud. A superuser compromise there isn't a single-site problem; it's a view into everything the network touches. For managed service providers, whose VeloCloud tenants serve multiple clients, the blast radius is wider still.

Network infrastructure like this is exactly what falls through the cracks when nobody owns it. Cleverly Named Solutions provides managed IT and cybersecurity for SMBs across Niagara, Welland, and Saint John — including keeping the unglamorous infrastructure patched. Get in touch.