Arista's VeloCloud Hit by Third Exploited Zero-Day in Four Months

Arista Networks has a message for customers who patched their VeloCloud Orchestrator systems last month: do it again. The company disclosed on October 22 that attackers are already exploiting a new, separate flaw in the same product — the third actively exploited zero-day in that one product line since July.

What's actually broken

VeloCloud Orchestrator, or VCO, is the central dashboard that runs an SD-WAN setup — the technology companies use to link branch offices to headquarters over ordinary internet connections instead of expensive leased lines. Whoever controls the Orchestrator effectively controls how traffic moves across every connected site.

The new bug, tracked as CVE-2026-114625, is a SQL injection flaw — a way of sneaking commands into a system by hiding them inside a form field or request the application wasn't built to question. Arista says the flaw lets a logged-in user, even one stuck with the lowest customer-level permissions, climb all the way up to operator-level superuser access, unlocking internal functions that should never be reachable from a regular account. It scored 9.9 out of 10 on the CVSS severity scale, a rating usually reserved for flaws that are both trivial to exploit and catastrophic once someone does.

A "zero-day," for anyone who hasn't run into the term, just means a vulnerability that's being used by attackers before — or right as — a fix becomes available, leaving defenders no lead time to prepare.

Not an isolated incident

This is the third VCO zero-day that attackers have exploited in the wild in roughly four months. Arista pushed emergency fixes for CVE-2026-16812 in July and CVE-2026-93952 in September. Orchestrators that were patched for the September flaw are not protected against this one and need the new update separately. The fixed versions are 5.2.3.18, 6.1.3.10, and 6.4.2.12 or later.

Three exploited zero-days in the same product, four months apart, isn't bad luck. It's a pattern an attacker group appears to be actively mining.

The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog within a day of disclosure — effectively a formal "patch this immediately" flag that security teams worldwide track, the same way India's own CERT-In pushes advisories for actively exploited bugs affecting Indian networks.

Arista's interim advice for anyone who can't patch immediately:

• Restrict web interface access to the Orchestrator to trusted administrative networks only
• Watch access logs for unusual authentication or privilege-escalation activity
• Apply the fixed firmware versions as soon as a maintenance window allows, even if you patched in September

Why Indian enterprises should pay attention

SD-WAN adoption has grown fast among Indian banks, IT services firms, and retail chains precisely because it's cheaper than dedicated leased lines for connecting dozens or hundreds of branch offices — exactly the setups VeloCloud Orchestrator is built to manage. A compromised Orchestrator doesn't just expose one office; it can expose the routing and traffic of every branch tied to it, which is a bigger blast radius than most single-server breaches. Indian IT and BFSI (banking, financial services, and insurance) security teams running VeloCloud deployments should treat this the same way CERT-In advisories ask organisations to treat any KEV-listed flaw: patch first, investigate logs after, not the other way around.

The bigger worry

One exploited bug is a bad week. Three in four months, in the device that sits at the center of a company's entire branch network, starts to look like attackers have found a reliable way back in no matter how fast Arista ships fixes. It's part of a wider trend Code24 has been tracking through 2026, where the very appliances enterprises rely on to secure their networks — VPN gateways, access managers, SD-WAN controllers — keep turning up as the entry point instead. For security teams, that changes the calculus from "patch and move on" to "assume this box is a standing target and monitor it accordingly."