On October 22, 2026, Arista Networks fixed a VeloCloud Orchestrator zero-day vulnerability that attackers had already exploited. The vulnerability puts businesses at risk because it affects the system used to handle network connections across multiple sites.
How a read-only account becomes a superuser
Advisory 0199 of Arista identifies the vulnerability as CVE-2026-114625, an SQL-injection vulnerability rated 9.9 under CVSS v3.1. The danger lies in how much control an attacker can gain, even with the lowest level of access.
To take advantage of the vulnerability, an attacker needs access to the web interface and valid login credentials. Once logged-in, the attacker can use the SQL-injection vulnerability to elevate an Enterprise Read Only account, the platform’s lowest-privilege role, to operator privileges and impersonate a superuser. The vulnerability therefore allows someone with read-only access to gain control over the platform. Arista confirmed that attackers have already exploited the vulnerability.
The patches and the forensic checklist
On-premises operators should check their software versions. Affected 5.2.x, 6.1.x and 6.4.x releases require fixed builds 5.2.3.18, 6.1.3.10 and 6.4.2.12, respectively, or later releases in those trains. Hosted and Dedicated deployments are already patched.
According to Arista, both attacks originated from the following source IPs: 74.82.197.86 and 38.54.50.151. The company advises system administrators to look into suspicious web requests, unexpected outbound connections, and unusual administrator activity. It also recommends limiting management access to trusted networks and preserving relevant logs if case of a suspected breach.
The third VeloCloud flaw since summer
The SQL-injection vulnerability is the third actively exploited flaw reported in VeloCloud Orchestrator within three months.
Arista’s advisory 0144, first issued on July 27, 2026, covered an OS command-injection vulnerability. Another flaw was disclosed on September 22 through advisory 0183. Both involved different methods of attack from the latest vulnerability.
Even though there are differences between the three vulnerabilities, they still affected the same central management platform. Since VeloCloud Orchestrator manages connections across multiple sites, a breach to the platform could compromise several networks.
Patches now land after the exploits
Verizon’s 2026 Data Breach Investigations Report revealed that vulnerability exploitation accounted for 31% of data breaches. It has overtaken stolen credentials as the leading method attackers used to gain access to networks. The results emphasize the need for businesses to fix vulnerabilities before attackers take advantage of them.
However, businesses are usually unable to fix vulnerabilities before attackers take advantage of them. According to the Google M-Trends 2026 report, attackers exploit system vulnerabilities for an average of seven days before a fix is available. The report further mentioned some threats against network devices such as VPNs and routers that do not have a standard endpoint monitoring.
AI could make the situation more dangerous. In a separate investigation, Google researchers documented attackers using AI to plan and execute a large-scale credential-harvesting campaign in under six hours. The operation compromised thousands of third-party credentials.
Although there is no confirmed evidence that AI played a role in the VeloCloud attacks, Google’s findings show how AI-assisted operations can help attackers move faster and potentially cause greater damage before security teams can respond.
Why successive fixes matter for a growing market
Cyberattacks can have serious financial consequences. IBM’s 2026 study estimated the average global cost of a data breach at $4.99 million. Concerns about emerging threats are also growing. The World Economic Forum found that 87% of respondents considered AI-related vulnerabilities the fastest-growing cyber risk during 2025.
The potential impact could grow as more businesses adopt SD-WANs, or software-defined wide-area networks, which connect multiple offices and allow companies to manage network traffic centrally. Dell’Oro Group forecasts 14% annual SD-WAN revenue growth through 2030. As these networks expand, a compromised central controller could disrupt business operations across multiple locations, potentially affecting companies in different countries.
Financial markets face similar concerns about operational disruptions. Cryptopolitan previously reported attempted cyberattacks against major hedge funds, raising questions about possible spillover into crypto markets. Although those incidents were separate from the VeloCloud attacks, they highlight the importance of protecting critical systems. For businesses using VeloCloud, that means applying patches, checking for earlier signs of compromise and securing the systems that connect their branches.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.