Three VeloCloud Orchestrator bugs in one quarter: what CVE-2026-114625 says about the product's attack surface

Arista's advisory for CVE-2026-114625 includes a line that is easy to skim past: this is the third VCO flaw since late July that the company has reported as exploited.

Three exploited vulnerabilities in one product line in roughly three months form a pattern separate from the severity of any single bug.

The three flaws

The current flaw is the first of the three that requires credentials. It is a SQL injection that lets an authenticated low-privilege account act as a local superuser on the orchestrator. VCO is exposed by default and Arista states no VCO setting prevents that exposure.

What the sequence suggests

The orchestrator is the component that holds configuration for every SD-WAN edge a tenant operates. It is reachable from the internet because partners and customers manage networks from wherever they are. It runs a web application with a database behind it. Those properties make it a natural target, and the repeated exploited-in-the-wild reports indicate someone is already working that surface.

For defenders, the sequence also breaks a common assumption. Teams that patched in July and again in September may believe VCO is handled. They are not, because the builds that closed those flaws sit below the new fixed releases.

Where each train stands

On 6.1, the September flaw affects releases up to 6.1.3.7 and no fix is listed. Neither advisory says whether 6.1.3.10 closes it. A 6.1 operator should confirm that with Arista rather than assume.

Hosted and Dedicated orchestrators were patched by Arista for the current flaw. Gateway and Edge devices are not affected by it. The 7.0 train is not listed as affected.

Exposure numbers and what they do not say

A ZoomEye query for title="VeloCloud" returns 529 assets. Application-fingerprint queries for the product returned zero in this check, so the title match is the usable signal. It counts visible web surface bearing the VeloCloud name. It does not count vulnerable builds, and it does not distinguish hosted from self-managed deployments.

Reading the vendor's mitigations as a set

Arista's interim guidance has stayed consistent across the three flaws: limit VCO web interface access to trusted administrative networks, monitor for known malicious addresses, watch the host for unexpected outbound traffic, block outbound ports normal operations do not need, look for backdoor daemons and webshells, and review recent administrator activity.

The two addresses named for the current flaw are 74.82.197[.]86 and 38.54.50[.]151. Log patterns to check include unusual URL-like path components, encoded characters, references to local or internal services, and high request rates.

The advice repeats across all three advisories. It describes the controls Arista expects to matter for this class of bug, and it implies the interface will keep being reachable.

The questions left open

The advisory does not say whether upgrading removes access an attacker already gained, and it does not repeat the earlier warnings about a compromised orchestrator exposing edge devices. Those gaps mean a patch closes the code path, and a full response still needs a look at what happened before the patch.

Sources

• Arista Security Advisory 0199: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
• Arista Security Advisory 0183: https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
• The Hacker News report: https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html