Affected Systems
Arista VeloCloud Orchestrator (VCO) versions before 5.2.3.18, 6.1.3.10, and 6.4.2.12. On-premises deployments affected; Hosted and Dedicated orchestrators already patched. VeloCloud Gateway and Edge devices not affected. Release train 7.0 not vulnerable.
Exploitation Status
Active exploitation confirmed. Two attacker IP addresses identified: 74.82.197.86 and 38.54.50.151. This is the third actively exploited VeloCloud zero-day since July 2026.
Business Impact
Attackers with minimal access (read-only customer account) can escalate to operator-level privileges, gaining full control over SD-WAN management. This enables exposure, modification, or disruption of orchestrator data and potentially the underlying host. Organizations using on-premises VCO for SD-WAN management face immediate risk of complete infrastructure compromise. CVE-2026-114625 scored 9.9 CVSS.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade on-premises VeloCloud Orchestrator to fixed versions: 5.2.3.18, 6.1.3.10, or 6.4.2.12 immediately
- Block attacker IPs 74.82.197.86 and 38.54.50.151 at perimeter and check VCO web access logs for connections from these addresses
- Restrict VCO web interface access to trusted administrative networks only until patching is complete
- Review VCO web access logs for unusual URL-encoded characters, references to internal services, or abnormal request rates indicating SQL injection attempts
- Audit recent administrator activity and check for backdoor daemons, webshells, or unexpected outbound network connections from VCO hosts; preserve logs and filesystem timestamps if compromise is suspected