A Read-Only Login Now Owns Your SD-WAN. VeloCloud Orchestrator’s Third Exploited Zero-Day Since July.

01 What Arista disclosed on 22 October

Arista’s description goes past the database. The flaw gives a remote attacker privileged internal functionality on the VCO host, and Arista names confidentiality, integrity and availability of the orchestrator and the data it manages as all at risk [ Arista 0199 ] . Arista did not assess versions that are out of support. If you run one, you have no fixed build to install, and Arista asks you to contact its TAC.

02 Why a read-only login is enough

Most teams rank a read-only account as harmless. They hand it to the managed service provider’s junior engineer, to a branch IT contact who wants to watch link health, to an auditor, to a monitoring integration. Nobody reviews those accounts with the care they give to operators.

CVE-2026-114625 turns each of them into a superuser. Arista sets the minimum role at Enterprise Read Only, the lowest built-in tenant role. A valid session plus network access to the portal is the whole precondition [ Arista 0199 ] . An attacker who phished one tenant viewer, bought one reused password, or found one forgotten integration account now holds the keys to the operator console.

That last line deserves attention. Arista writes that VCO is exposed by default and that no configuration prevents the exposure [ Arista 0199 ] . You cannot switch a feature off and wait for the change window. The fix is the upgrade, and until then the only control you own sits in front of the portal: who can reach it at all.

03 Three orchestrator zero-days in three months

Secondary reports disagree on the count. BleepingComputer lists four exploited Arista zero-days in 2026 [ BleepingComputer 2026 ] . CISA’s catalogue shows that one of the four, CVE-2026-7473, sits in Arista EOS, the switch operating system, and was added on 9 June [ CISA KEV ] . Against the orchestrator itself, the number is three, all since late July.

Sources: Arista advisories 0144, 0183 and 0199 [ Arista 0144 ] [ Arista 0183 ] . CISA added the July flaw to its Known Exploited Vulnerabilities catalogue on the day Arista disclosed it, with a federal deadline three days later. It did the same for the September flaw, with a deadline of 25 September [ CISA KEV ] .

04 One orchestrator, every branch

An SD-WAN replaces dozens of separately managed branch routers with one control point. That is the selling point. The orchestrator holds the configuration for every edge, the routing and security policy between sites, and the credentials the edges use to check in. An operator change in the portal reaches every branch that trusts it.

Turn that around and you have the attacker’s view. One superuser session on the orchestrator reaches more of your network than one compromised branch firewall ever could. The attacker who holds it can read how every site connects, change where traffic goes, and create the operator account they will use next month. Arista’s own mitigation list tells you what it expects them to try: backdoor daemons, web shells and unexpected outbound traffic from the VCO host [ Arista 0199 ] .

Arista sells to more than 10,000 customers worldwide [ BleepingComputer Sep 2026 ] . Neither Arista nor the coverage gives a count of on-prem orchestrators on the internet. You do not need the global figure. You need to know whether yours is one of them.

05 Five checks before Monday

Upgrade first. Arista says to move to a fixed release as soon as possible [ Arista 0199 ] . Then run these five checks, because the upgrade closes this bug and leaves the conditions that made it dangerous in place.

• Internet exposure. Scan your own public address ranges for the VCO portal from outside your network. If it answers, you have found the first thing an attacker finds. Edges need to reach the orchestrator; your admins and tenants do not need to reach it from any coffee shop on earth.
• Admin segmentation. Arista’s first mitigation is to restrict the web interface to trusted administrative networks. Put the portal behind a management VPN or jump host, and confirm with a test from an ordinary office network that the rule holds.
• Low-privilege accounts. Export every tenant and operator account. Delete the ones nobody can name an owner for, and put MFA on every login that remains. After this advisory, a read-only account deserves the same review as an operator account.
• Patch level. Record the exact build on every orchestrator, including the lab and disaster-recovery copies. Anything below 5.2.3.18, 6.1.3.10 or 6.4.2.12 is open. Anything on an out-of-support train has no fix and needs a migration plan this quarter.
• Logs. Make sure VCO web access, application, system and database logs leave the box and land somewhere an attacker with superuser rights cannot edit. If they only live on the orchestrator, the person who owns it now also owns your evidence.

Arista also advises blocking outbound ports the VCO host does not need [ Arista 0199 ] . An orchestrator that cannot open a connection to an unknown server on the internet is a much poorer foothold.

06 Were you hit before you patched?

The upgrade stops the next attacker. It does nothing about one who already logged in as a superuser and left a way back. Arista asks you to preserve logs and file-system timestamps before you remediate, where you can [ Arista 0199 ] . Take the copy first, then patch, then look.

CISA flags both earlier VCO entries for forensic triage in its catalogue [ CISA KEV ] . That is a signal worth copying: on this product, assume the patch arrived after the attacker and prove otherwise.

Three exploited bugs in three months tell you the orchestrator is on someone’s target list. You can learn what they would find first. Your Threat Map tests your management plane from outside and from a low-privilege login, shows you every route from the internet to your orchestrator and the branches behind it, proven, with the fix ranked by what each route reaches. 14 days, from $5,000. Enterprise-grade. Not enterprise-priced.