Arista patches exploited VeloCloud Orchestrator flaw
Arista says the on-premises flaw lets an authenticated user gain operator privileges and advises administrators to patch and restrict web access.
Loading… Բեռնվում է…
Arista says the on-premises flaw lets an authenticated user gain operator privileges and advises administrators to patch and restrict web access.
Arista Networks has released security updates for a critical flaw in on-premises VeloCloud Orchestrator that the company says attackers are actively exploiting, BleepingComputer reported on 22 October. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on 23 October, citing reports of active exploitation, The Hacker News reported on 24 October.
VeloCloud Orchestrator, or VCO, is a web-based portal for configuring, monitoring and managing software-defined wide-area networks—networks controlled through software—and their associated edge devices. BleepingComputer describes the flaw as a zero-day, meaning attackers exploited it before a fix was available. Releases containing fixes for VCO flaws exploited in July and September remain vulnerable to this flaw, The Hacker News reported on 22 October.
The catalog addition gives the vulnerability, tracked as CVE-2026-114625, an official US agency designation as a known exploited flaw. The Hacker News reports that it carries a critical severity rating of 9.9 on the CVSS vulnerability-severity scale and is the third VCO vulnerability exploited since July.
Arista acknowledges active exploitation but has not identified a particular attacker group, disclosed how many organizations were affected or detailed what attackers did after gaining higher privileges, according to The Hacker News.
Arista’s release-specific guidance identifies separate fixes for each affected release branch, The Hacker News reported on 22 October.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
| Release branch | Affected by CVE-2026-114625 | CVE-2026-114625 fixed in | September flaw fixed in |
|---|---|---|---|
| 5.2 | Before 5.2.3.18 | 5.2.3.18 and later in this branch | 5.2.3.16 |
| 6.1 | Before 6.1.3.10 | 6.1.3.10 and later in this branch | No fix listed |
| 6.4 | Before 6.4.2.12 | 6.4.2.12 and later in this branch | 6.4.2.8 |
As of 22 October, Arista listed fixes for September’s vulnerability, CVE-2026-93952, only in the 5.2 and 6.4 branches. Its September advisory lists affected 6.1 releases through 6.1.3.7 but no fixed release. Neither advisory says whether 6.1.3.10 also fixes September’s flaw, The Hacker News reported.
Arista says hosted and dedicated orchestrators have already been patched. BleepingComputer also reported the same three version thresholds for patched hosted deployments.
CVE-2026-114625 requires an attacker to have basic privileges, network access to the VCO web interface and a valid signed-in session. BleepingComputer describes it as a low-complexity SQL injection flaw, which allows malicious input to manipulate database commands, and says exploitation requires no user interaction.
According to Arista, any authenticated user on an affected system can gain operator privileges and impersonate a local “superuser operator”, gaining access to internal functions not intended to be available remotely. Exploitation may affect the server running VCO, expose or alter managed data, or disrupt access to the orchestrator and its data.
Until patches are installed, Arista advises administrators to restrict the VCO web interface to administrative networks, monitor connections from known malicious addresses and review administrator activity for unusual changes. Administrators should check web access logs for unusual URL-like path components, encoded characters, references to local or internal services, and unusually high request rates.
Arista specifically advises blocking 74[.]82.197.86 and 38[.]54.50.151, which it says have been observed in the ongoing attacks.
If compromise is suspected, Arista advises preserving VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediation, where operationally feasible. Customers can contact Arista’s Technical Assistance Center for help.
US Federal Civilian Executive Branch agencies are recommended to apply the fixes by 26 October because of the active exploitation, The Hacker News reported.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
Correction ·
Corrected the wording of the English and Armenian versions.
Update ·
CISA listed the flaw on 23 October, and US federal civilian agencies are advised to apply fixes by 26 October.
Update ·
Adds the on-premises fixed versions, explains why earlier patches are insufficient and identifies the unresolved question of whether 6.1.3.10 also fixes September's flaw.