Arista’s October 22 security advisory confirms active exploitation of CVE-2026-114625 in VeloCloud Orchestrator (VCO). This is an authenticated SQL-injection issue, not an unauthenticated attack: a valid portal session with the Enterprise Read Only role—the lowest built-in tenant role—is sufficient to escalate to operator privileges and impersonate a local superuser operator.
Identify the deployment, then the release
The affected product is on-premises VCO, formerly VeloCloud Orchestrator by Broadcom. Hosted and Dedicated VCO instances were affected but have already been patched, according to Arista. VeloCloud Edge and Gateway are listed as unaffected. Unsupported software releases have not been assessed; an absent assessment is not a clean bill of health.
| VCO release train | Affected versions | Fixed release |
|---|---|---|
| 5.2 | Before 5.2.3.18 | 5.2.3.18 or later in this train |
| 6.1 | Before 6.1.3.10 | 6.1.3.10 or later in this train |
| 6.4 | Before 6.4.2.12 | 6.4.2.12 or later in this train |
Arista rates the flaw CVSS 3.1 9.9. Exploitation requires network access to the web interface and authentication, but the vendor says no product configuration eliminates exposure. Restricting portal reachability is defense in depth, not a substitute for the fixed software.
Preserve evidence while closing exposure
Arista recommends preserving web-access, backend-application, system and database logs, plus relevant filesystem timestamps, before remediation where operationally feasible. It also calls for reviewing unexpected administrative changes, outbound activity and possible webshells or backdoor daemons. Unusual encoded paths, internal-service references or request bursts warrant investigation; they do not establish compromise on their own.
Bulwark assessment for lean teams
- Name the control-plane owner. Confirm whether your organization or a service provider runs the orchestrator. Obtain the actual installed build and a named remediation owner, not merely an assurance that the SD-WAN service is available.
- Review low-privilege identities too. Scope the portal account inventory beyond administrators. Investigate unexpected sessions and role changes, and preserve the evidence used to distinguish legitimate support work from unauthorized actions.
- Separate patch completion from incident closure. A corrected build closes this vulnerability; it does not explain earlier privileged activity. If compromise is suspected, involve the vendor and your incident responder in validating host integrity and reviewing secrets accessible to the control plane.
- Document operational risk. Coordinate access restrictions and upgrades with network operations. Keep an independently accessible recovery plan and record which historical logs are missing.
Evidence limits
The vendor confirms exploitation, but this advisory does not establish that any particular customer was compromised or provide a victim count or actor attribution. Do not translate a high severity score into evidence of intrusion.
Original source: Arista Security Advisory 0199, initial release October 22, 2026.