---
title: "Arista VeloCloud Orchestrator Zero-Day and What To Do Next"
description: "Arista confirms active exploitation of its on-premises orchestrator flaw. Authenticated users can escalate to superuser. Hosted is patched. On-premises customers must act."
url: https://policycortex.com/blog/arista-vco-zero-day-superuser-escalation
sealed: 2026-10-22
register: blog/arista-vco-zero-day-superuser-escalation
records: 3
digest: sha3:d440c9f6f29ce7c78260c5802fc6387a6e2528729d5c8a0305fdfb697b17a4b5
---

# Arista VeloCloud Orchestrator Zero-Day: A Signed-In User Becomes Superuser

Resources / Blog

Arista confirms active exploitation of the on-premises VeloCloud Orchestrator flaw. A signed-in user can reach superuser rights through SQL injection.

Leonard Esere · Sealed 2026-10-22 · Reading time 5 min

Filed under: [Arista](https://policycortex.com/blog/tags/arista), [VeloCloud Orchestrator](https://policycortex.com/blog/tags/velocloud-orchestrator), [zero-day](https://policycortex.com/blog/tags/zero-day), [SQL injection](https://policycortex.com/blog/tags/sql-injection), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation), [NIST 800-53](https://policycortex.com/blog/tags/nist-800-53)

**Summary**

- Arista confirms active exploitation in the wild. The flaw affects on-premises VeloCloud Orchestrator deployments.
- Any authenticated user can gain operator privileges. That user can pose as a local superuser operator.
- Arista patched its hosted service. Patched levels include 5.2.3.18, 6.1.3.10, and 6.4.2.12.
- Arista published two attack addresses: 74.82.197.86 and 38.54.50.151. Check your logs for both today.

## A basic account becomes the top account

A software-defined wide area network (SD-WAN) links branch sites over shared connections. VeloCloud Orchestrator (VCO) is the web console that manages that network. Admins use it to configure and monitor edge devices.

Arista confirms attackers are exploiting a flaw in on-premises VCO. The flaw is tracked in the Common Vulnerabilities and Exposures program as [CVE-2026-114625](https://www.cve.org/CVERecord?id=CVE-2026-114625). Arista published the issue as Security Advisory 0199 on October 22, 2026, scoring it 9.9 out of 10 under CVSS version 3.1. Read the full [Arista Security Advisory 0199](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199).

## How the escalation works

The attack starts with a valid signed-in session. The user needs basic privileges and access to the web interface. Arista describes a Structured Query Language (SQL) injection path. The attack needs no further user interaction.

On an affected system, any authenticated user can gain operator privileges. That user can pose as a local superuser operator. The prize is functions meant for internal use only. Those functions were never meant to be reachable remotely.

Arista warns about the wider impact too. Successful exploitation may harm confidentiality, integrity, and availability. The risk covers the orchestrator and the data it manages.

## Hosted is patched. On-premises is yours.

Arista says it already patched its hosted VCO service. The patched levels are 5.2.3.18, 6.1.3.10, and 6.4.2.12. Those numbers describe the hosted service state.

On-premises customers run their own orchestrators. Nobody patches those systems for them. Each customer must patch or check for compromise.

PolicyCortex does not patch Arista gear. Your Arista support path owns that work.

## What to check now

Arista published indicators of compromise (IOCs) for this flaw. The two Internet Protocol (IP) addresses are 74.82.197.86 and 38.54.50.151. Block both addresses and search your logs for them.

Arista also lists log signs worth hunting. Look for requests with unusual path components. Look for encoded characters and references to internal services. Look for high request rates and odd administrator activity.

Restrict the web interface to administrative networks for now. Preserve logs before remediation where you can. Arista lists web, backend, system, and database logs. It also lists file system timestamps. Contact the Arista Technical Assistance Center (TAC) if you suspect compromise.

## The governance lesson

Management planes are part of the system. They are not side tools outside the boundary. A console that configures every edge device carries full network risk.

Governance means you fully understand that layer. Inventory every orchestrator you run. Record its version, its owner, and its patch state. Record who can sign in and from where.

An inventory that skips management planes has a hole. This flaw walked through exactly that hole.

## Sources

- [Arista Security Advisory 0199](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199), October 22, 2026. Arista describes the on-premises VCO issue, the CVSS 9.9 score, and its internal only functions.
- [CVE-2026-114625](https://www.cve.org/CVERecord?id=CVE-2026-114625) record, CVE Program. The record is in reserved state at publication time.
- BleepingComputer, Arista patches new VeloCloud Orchestrator zero-day. https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/ Reporting quotes Arista on versions, IOCs, and log checks.
- Original diagram by PolicyCortex.

## Next step

Want management plane patch evidence collected on a schedule? See how [PolicyCortex](https://policycortex.com) reads it from the live tenant.

**Questions on this record**

**Q: What is this flaw?**
A: It is a Structured Query Language injection flaw in VeloCloud Orchestrator. An authenticated user can escalate to operator or superuser rights.

**Q: Is the hosted service patched?**
A: Yes. Arista says it patched hosted deployments. The patched levels are 5.2.3.18, 6.1.3.10, and 6.4.2.12.

**Q: What must on-premises customers do?**
A: Patch to a fixed level from Arista. Then check logs for the two published attack addresses.

## Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

- **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
- **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes.
- **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it.
- **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence.

### Further reading in this register

| Published | Entry | Reading |
|---|---|---|
| 2026-10-22 | [GitLab Critical Flaw: Unauthenticated Code Execution on the Server](https://policycortex.com/blog/gitlab-cve-2026-110264-rce-governance): CVE-2026-110264 scores 10.0 Critical and lets an unauthenticated user run code on a GitLab server. The fix is a patch release. | 5 min |
| 2026-10-22 | [Four Exploited Flaws Hit the Firewall, the Mail Gateway, and the Backup Server](https://policycortex.com/blog/kev-edge-appliances-palo-alto-cisco-ahsay): CISA added four exploited flaws on October 14, 2026. They hit a Palo Alto Networks firewall, a Cisco email gateway, and an Ahsay backup server. | 5 min |
| 2026-10-22 | [PwnEscape: The Linux Kernel Flaw That Escapes the Virtual Machine](https://policycortex.com/blog/pwnescape-linux-kernel-guest-host-escape): CVE-2026-99999 scores 9.3 Critical and lets a guest VM read host memory, crash the host, and run code as root. The fix is a host kernel update. Guest patches do not help. | 5 min |

Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

Dates of record

- **Published**: 2026-10-22
- **Last updated**: Unchanged since sealing
- **Author**: Leonard Esere
- **Record**: https://policycortex.com/blog/arista-vco-zero-day-superuser-escalation

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | HEAD | e4954e9fd8b7 | bc24e10f6804 |
| REC 0001 | BODY | 7490a250c262 | e4954e9fd8b7 |
| REC 0002 | RELATED RECORDS | d440c9f6f29c | 7490a250c262 |

Head sha3:d440c9f6f29ce7c78260c5802fc6387a6e2528729d5c8a0305fdfb697b17a4b5. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.