Arista Networks said attackers are exploiting a flaw in the on-premises version of VeloCloud Orchestrator, a web portal for managing SD-WAN networks. Arista tracks it as CVE-2026-114625 and rates it 9.9 out of 10. It says it detected the issue and that it is known to be actively exploited. Hosted versions, including Dedicated ones, are already patched. BleepingComputer reported on 22 October that hosted systems on the 5.2, 6.1 and 6.4 lines now run patched builds.
Arista says the portal is exposed by default, and no setting prevents this. An attacker needs network access to the web page and a valid login. Arista's advisory tells on-prem customers to upgrade once a fixed release is available, but it names no fixed on-prem version. Who is behind the attacks and how many customers were hit are not stated. BleepingComputer added that teams should block two addresses seen in the attacks: 74[.]82.197.86 and 38[.]54.50.151.
A login sounds like protection, but here the lowest tenant role is enough. Through SQL injection, which feeds a database crafted input, that user can pose as a superuser operator and reach internal-only functions. Leaders should ask who holds portal accounts, whether the portal is reachable beyond admin networks, and whether logs are being saved. Arista advises restricting access and preserving logs before any cleanup.