Urgent awareness alert. This is awareness content, not a monitored threat intelligence service: always check vendor advisories against your own environment.
Arista has released fixes for a critical vulnerability (CVE-2026-114625, CVSS 9.9) in VeloCloud Orchestrator On-Prem, the management platform for VeloCloud SD-WAN, formerly sold by Broadcom. Arista says the flaw is known to be actively exploited. It is an SQL injection weakness that lets any authenticated user, even one with the lowest built-in role (Enterprise Read Only), gain operator privileges, pose as a local “superuser operator”, and reach internal functionality that can affect the Orchestrator host. Arista notes that the Orchestrator is exposed by default and that no configuration setting prevents the exposure. On-premises versions 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12 are affected. Arista has already patched its Hosted and Dedicated Orchestrator services, and VeloCloud Edge and Gateway devices are not affected.
What to do:
- Upgrade on-premises Orchestrators to 5.2.3.18, 6.1.3.10, 6.4.2.12, or later. If you run an unsupported release, contact Arista support about upgrade options.
- Check for compromise: review web access logs for unusual requests and for the IP addresses 74.82.197.86 and 38.54.50.151, and look for webshells, unexpected outbound connections, and unexpected administrator changes. Preserve logs before remediating if you suspect compromise.
- Restrict access to the Orchestrator web interface to trusted administrative networks, and block the IP addresses above.
Source: Arista Security Advisory 0199
If you would like help assessing your exposure, contact us.
