Third VeloCloud zero-day since July: the build that closes all three

Arista said on October 22 that attackers are exploiting CVE-2026-114625, a SQL injection flaw in the on-premises VeloCloud Orchestrator (VCO), the console that runs VeloCloud SD-WAN networks. It is rated 9.9 on CVSS 3.1. Any user who can sign in, even one holding Enterprise Read Only, the weakest tenant role VCO ships with, can pose as a local "superuser operator" and reach functions that were never meant to be reachable from outside. Arista found the attacks itself. Its advisory says VCO is exposed by default and that no setting prevents it. Hosted and Dedicated orchestrators are already patched, so on-premises customers are the ones who have to act. VeloCloud Edge and Gateway devices are not affected. WindowsForum reports that CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 23.

This is the third exploited VCO flaw since July, and the first that needs a login. CVE-2026-16812 (advisory 0144, July 27) and CVE-2026-93952 (advisory 0183, September 22) are both rated 10.0, and neither needs credentials. CISA had already put both on its exploited list, SecurityOnline notes. Arista has not said when the October attacks started, whose orchestrators were breached or what the attackers did once inside.

A team that runs its own orchestrator and is behind on updates needs the build that closes all three. Each advisory lists only its own fix, so the answer comes from reading them side by side.

Which build closes all three

On 5.2 and 6.4 the October build is the newest of the three fixes, so one upgrade covers everything.

The 6.1 train is less clear. The September advisory, still at revision 1.1 from September 23, lists 6.1.3.7 and below as affected and gives no 6.1 fix, only a line that fixes for other trains "will be added over time." Build 6.1.3.10 sits above that affected range, but the advisory never says it fixes the flaw. Aardwolf Security, citing The Hacker News, says it is unclear whether 6.1.3.10 covers the earlier issue.

The 7.0 train is the odd one. The October advisory does not list 7.0, and Arista says a release that is not listed is not vulnerable. The September advisory does list 7.0.0.2 and below as affected and names no 7.0 fix, and the July advisory covers 7.0 releases before 7.0.0.1 but names no fixed 7.0 build in its resolution section. The July and October advisories say end-of-support releases were not assessed.

Indicators from all three advisories

Each advisory names its own attacker addresses. Together that is seven to block and search for in VCO web logs:

• July (0144): 8.19.75.217, 206.72.242.124, 206.72.242.162
• September (0183): 142.93.149.77, 104.248.126.159
• October (0199): 74.82.197.86, 38.54.50.151

The September advisory also lists files to look for: .vcnode.js and vc-sysmond in /usr/local/sbin/, and a vc-sysmon.service unit in /etc/systemd/system/, plus an x-vc-opt header in nginx logs. Its exposure needed certificate-based authentication from Edge to VCO to be switched on. The July and October flaws need no special setup.

Patching does not undo a break-in. Writing about the September flaw, Network World quoted Andrew Costis of AttackIQ as warning that a compromised orchestrator can reach the Edge devices it manages. Aardwolf advises treating an orchestrator that faced the internet before it was patched as a possible incident until its logs show otherwise.

Related: GitLab's backport gap and PHP2Shell patch paths.