Three exploited flaws have hit Arista VeloCloud Orchestrator On-Prem since July 2026. Each is a different kind of bug, and Arista says the product is “exposed by default”.
CISA added all three to its Known Exploited Vulnerabilities catalog, on 27 July, 22 September and 23 October. From the first listing to the third is 88 days. This post follows the advisories in order, then covers what the run means for people who operate an orchestrator. The listing dates come from CISA’s catalog.
Last updated: 25 October 2026. The advisories were read on that day.
- Start2026-07-27 ExploitedAdvisory 0144 for CVE-2026-16812, listed by CISA the same day
- +57 d2026-09-22 ExploitedAdvisory 0183 for CVE-2026-93952, listed by CISA the same day
- +30 d2026-10-22 ExploitedAdvisory 0199 for CVE-2026-114625
- +1 d2026-10-23 CISA KEVCISA lists CVE-2026-114625
The advisories are 57 days apart, then 30 days apart. The highlighted span runs from the first advisory to the third CISA listing.
27 July: Command Injection With No Login
Arista’s advisory 0144 covers CVE-2026-16812, an OS command injection (CWE-78). Its CVSS 3.1 score is 10.0. The vector needs network access only: no privileges and no user interaction.
Arista wrote that the issue “was discovered externally and is known to be actively exploited”. It also wrote that there is “no configuration that can prevent the exposure”. CISA listed the flaw on the same day.
The advisory names 5.2.x before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4 and 7.0.x before 7.0.0.1 as affected. The fixed builds are 5.2.3.14, 6.1.3.4 and 6.4.2.4 or later, and the resolution names no 7.0 release. Arista did not assess versions past end of support. A revision on 3 August added VCO Hosted to the affected products, and Arista said it was patching Hosted and Dedicated itself.
22 September: Input Validation, With One Setting Required
Fifty-seven days later, advisory 0183 described CVE-2026-93952, an improper input validation bug (CWE-20). It scores 10.0 on CVSS 3.1 and 9.5 on CVSS 4.0. Arista again said the issue was discovered externally and is known to be actively exploited, and CISA listed it that day.
This one has a precondition. The orchestrator must be set up for certificate-based authentication from VeloCloud Edge devices. An attacker then needs network access to the web interface and the public part of a VeloCloud Edge authentication certificate, but no orchestrator credentials.
The advisory lists 5.2.x through 5.2.3.15, 6.1.x through 6.1.3.7, 6.4.x through 6.4.2.7 and 7.0.x through 7.0.0.2 as affected. Fixed builds are 5.2.3.16 and later, and 6.4.2.8 and later. Arista added that fixes for other trains “will be added over time”. Its workarounds repeat the first advisory’s and add two: block outbound ports you do not need, and look for backdoor daemons and webshells. Arista says Hosted and Dedicated were already patched.
22 October: SQL Injection From a Read-Only Role
Thirty days after that, advisory 0199 covered CVE-2026-114625, a SQL injection (CWE-89). The scores are 9.9 on CVSS 3.1 and 9.4 on CVSS 4.0. The wording changed: Arista says this issue “was detected by Arista” and is known to be actively exploited.
The attacker needs an account, but a weak one will do. Arista says an authenticated user can gain operator privileges and masquerade as the local “superuser operator”. The minimum role is Enterprise Read Only. Only On-Prem is affected, because Hosted and Dedicated were already patched. CISA listed the flaw on 23 October.
Arista lists two IP addresses to watch for, 74.82.197.86 and 38.54.50.151. Treat them as a starting point for log searches, not as a full picture of who is attacking. Arista’s advice for a suspected compromise is to preserve logs and file-system timestamps before remediation.
What Does This Run Mean for Orchestrator Owners?
Start with exposure. Arista wrote “VCO is exposed by default” in the first and third advisories. The first two bugs needed no login. The first needed only network access; the second also needed Edge certificate authentication to be configured and the public part of an Edge certificate. The one lever an owner holds is who can reach it, which Arista’s workarounds put first: limit the web interface to trusted admin networks. Knowing what faces the internet is the job of external attack surface management.
Next, the bugs do not repeat. A command injection, an input validation bug and a SQL injection are three classes. The advisories do not tie them together and do not name an attacker, so we do not either. What they share is the product and the way it is deployed. The practical effect is that a build which fixed the first flaw did not fix the next two.
Third, each fix landed on a different set of builds. The latest bug needs newer builds than the second, and the second left the 6.1 train without a listed fix at the time. Two gaps, 57 and 30 days, are too few to set a pace and we do not predict the next advisory. We would plan as if one will come.
Attention follows fast. Our X capture holds 224 distinct posts since 25 July that mention VeloCloud or one of the three CVE ids. The two broad searches returned only their newest 100 posts, so read the total as a floor, not as a timeline.
The searches that were not cut off show the same pattern as the dark web data. Of the 14 posts naming CVE-2026-16812, 12 fall between 27 July and 2 August. Of the 17 naming CVE-2026-93952, 14 fall on 22 and 23 September.
Our dark web monitoring, THANOS, counts 95 posts that mention VeloCloud since 25 July: 83 on Telegram, 8 on forums and 4 on Discord. Thirteen name CVE-2026-16812, 11 name CVE-2026-93952 and 9 name CVE-2026-114625. In the dark web data the counts cluster around the days the advisories came out.
Which Builds Cover All Three?
Take the highest fixed build per train from the three advisories. These are the minimum builds that cover all three flaws, as the advisories read on 25 October.
| Flaw | What an attacker needs | Fixed builds |
|---|---|---|
| CVE-2026-16812, advisory 0144 | Network access to the web interface, no privileges | 5.2.3.14, 6.1.3.4, 6.4.2.4 or later |
| CVE-2026-93952, advisory 0183 | Network access, the public part of an Edge authentication certificate, Edge certificate authentication configured, no credentials | 5.2.3.16 or later, 6.4.2.8 or later |
| CVE-2026-114625, advisory 0199 | An account with role Enterprise Read Only or higher | 5.2.3.18, 6.1.3.10, 6.4.2.12 or later |
| Covers all three | 5.2.3.18, 6.1.3.10, 6.4.2.12 or later |
Arista rates the first two at a CVSS 3.1 score of 10.0 and the third at 9.9.
What Should You Check on Your Orchestrator?
Do these in order. The last step matters most if you find anything, because patching does not undo what an attacker already did.
- Who can reach itLimit the web interface to trusted admin networks. Check from outside your network that it no longer answers.
- Which build it runsCompare with 5.2.3.18, 6.1.3.10 or 6.4.2.12. Plan the upgrade now if you are below.
- Outbound trafficLook for unexpected connections from the orchestrator host. Block outbound ports you do not need.
- PersistenceLook for webshells and backdoor daemons, the two things advisory 0183 names.
- Admin activityReview recent admin actions and any session that holds operator rights, especially accounts that started as Enterprise Read Only.
- Source addressesSearch access logs back to 27 July for the two addresses in advisory 0199 and for other addresses you can tie to scanning.
- Evidence firstIf you suspect a compromise, preserve logs and file-system timestamps before you patch or rebuild.
CISA lists all three flaws with a forensic triage flag. In our reading, a patched system is not automatically a clean one. If the log search turns up something, treat the orchestrator as compromised until you can show otherwise.