Arista's fourth exploited zero-day of 2026 is in VeloCloud Orchestrator. Again.
By Lior AharonovFounder, 7IT Solutions ·
What happened
On 22 October 2026 Arista patched CVE-2026-114625, a SQL injection in on-premises VeloCloud Orchestrator that it says is under active attack. BleepingComputer reports an authenticated user can gain operator privileges and appear as a local superuser. Arista lists two attacker IP addresses and, per BleepingComputer, this is its fourth exploited zero-day this year.
Why it matters
The orchestrator manages your SD-WAN. Whoever becomes superuser there can change how your offices and cloud links talk to each other. A valid login is enough to start.
What to do
If you run VeloCloud Orchestrator on-prem, install Arista's fixed build today and limit its web interface to admin networks. Review recent admin activity and block 74.82.197.86 and 38.54.50.151.
Four exploited zero-days in one year is not bad luck. It's a pattern you should plan around.
Lior Aharonov · my takeSources
| Arista patches new VeloCloud Orchestrator zero-day exploited in attacks (BleepingComputer) | bleepingcomputer.com |
Researched with AI tools; every fact is checked against the linked sources.