VeloCloud Orchestrator: fixed versions and attack IPs

CVE-2026-114625 in on-prem Arista VeloCloud Orchestrator (VCO), a SQL injection rated CVSS 9.9 that lets any authenticated user pose as the “superuser operator”, was covered in the 23 October article, based only on CISA’s KEV catalog. Since then Arista’s security advisory 0199, reported by BleepingComputer, SecurityWeek and LeMagIT, and advisory AV26-1080 from the Canadian Centre for Cyber Security have added what orchestrator administrators need: the fixed versions, the IP addresses the attacks came from, what to look for in the logs and the mitigations to apply until you update.

Affected and fixed versions

According to the Canadian advisory and SecurityWeek, all VCO releases before the following are affected:

• 5.2.3.18;
• 6.1.3.10;
• 6.4.2.12.

The fix is included in these versions and later ones. Hosted instances have already been updated by Arista; if you run an on-prem orchestrator, you have to install the fix yourself. According to SecurityWeek, upgrading to a fixed release is the remediation Arista recommends, and the other measures only bridge the gap.

Who can exploit it

The sources agree on the prerequisites: the attacker must reach the VCO web interface and hold a valid authenticated session. SecurityWeek adds, quoting Arista, that the built-in tenant role with the lowest privileges is enough, that VCO deployments are exposed by default and that “there is no configuration that can prevent the exposure”. BleepingComputer and LeMagIT describe the injection as low-complexity, with no user interaction required.

The exploitation was detected by Arista itself (SecurityWeek). No source says who is behind the attacks, how many organizations were hit or what the attackers did after gaining access.

Indicators and what to look for in the logs

Arista published two IP addresses seen in the attacks, reported by BleepingComputer and SecurityWeek:

• 74.82.197.86
• 38.54.50.151

Block them and search for them in your logs. In the VCO web access logs, Arista also suggests looking for:

• requests with unusual URL-like path components;
• encoded characters;
• references to local or internal services;
• high request rates.

The sources do not describe the attack chain in detail, nor do they publish other indicators such as file hashes or web shell names.

If you suspect a compromise, Arista asks you to preserve evidence before remediation where operationally feasible: VCO web access logs, backend application logs, system logs, database logs and file-system timestamps. For assistance it points to its TAC.

Mitigations until you update

Until the fixed release is installed, Arista recommends (BleepingComputer and SecurityWeek):

• restricting access to the VCO web interface to administrative networks;
• reviewing recent administrator activity for unusual changes;
• monitoring connections from the known IPs and suspicious access.

Only SecurityWeek reports two further steps: blocking unneeded outbound ports and checking the host for backdoor daemons and web shells. In MITRE ATT&CK terms, exploitation maps to T1190 (Exploit Public-Facing Application) using a valid account (T1078); web shells would fall under T1505.003, but the sources mention them as a recommended check, not as an observed fact.

The third VCO zero-day in four months

According to SecurityWeek, CVE-2026-114625 is the third VCO vulnerability exploited as a zero-day in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September. BleepingComputer widens the count to all of 2026: besides this one, Arista has patched three other exploited zero-days across EOS and on-prem VCO, CVE-2026-7473 in May plus the July and September ones.

LeMagIT notes that Arista bought VeloCloud from Broadcom in July 2025; the product was previously part of VMware’s portfolio, which had acquired it in 2017.

Impact for European and Italian companies

The orchestrator runs the SD-WAN that connects offices and branches, including those of healthcare organizations spread across a region. Three exploited zero-days in a few months show the product is a recurring target: if you run an on-prem VCO, or have a provider run it for you, treat it as a critical system with fast patching and restricted management access. For NIS2 entities, timely vulnerability handling is among the required measures, and a compromise must be assessed for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN.

What to do now

1. Inventory: check whether you or your provider run an on-prem VCO and which version.
2. Update to 5.2.3.18, 6.1.3.10 or 6.4.2.12 (or later), depending on your branch.
3. Block and hunt for 74.82.197.86 and 38.54.50.151 in firewall and VCO logs.
4. Analyze the VCO web logs: unusual URL-like paths, encoded characters, references to internal services, bursts of requests.
5. Before any recovery, if you suspect a compromise, preserve web, backend, system and database logs and file-system timestamps.
6. In the meantime: management interface reachable only from administrative networks, review of administrator activity, unneeded outbound ports blocked, checks for web shells and backdoor daemons.
7. Accounts: remove unused tenant accounts, since the lowest-privilege role is enough.

How ARXDOME helps

ARX Sentry collects firewall logs in a central collector: connections to the orchestrator, including those from the IPs listed by Arista, remain available even if the host is compromised. ARX Radar shows in near real time who is attacking your public addresses, ARX Expose flags management interfaces exposed on the Internet and their known vulnerabilities, and with ARX Horizon you can search for indicators of compromise from the portal.

Last updated: 23 October 2026