Cybersecurity

VeloCloud SD-WAN Zero-Day: What Indian Firms Must Do Now

Affix Center · · 6 min read

Blue network cables plugged into equipment, representing SD-WAN network security

In short: On 22 October 2026, Arista disclosed CVE-2026-114625, a critical SQL injection flaw in on-premises VeloCloud Orchestrator, the system that manages VeloCloud SD-WAN networks. Arista says it is being actively exploited. Fixed versions are out. Organisations running their own orchestrator should patch now and check for signs of compromise.

If your branches, plants or offices are connected through VeloCloud SD-WAN, the orchestrator is the control room for that network. A flaw that lets an attacker take over the control room puts every site it manages at risk.

What Happened

According to Arista Security Advisory 0199, dated 22 October 2026, the VeloCloud Orchestrator (VCO) web interface has a SQL injection vulnerability tracked as CVE-2026-114625. Arista rates it 9.9 on CVSS v3.1 and 9.4 on CVSS v4.0.

The advisory says an attacker needs network access to the VCO web interface and a valid login. The lowest role, Enterprise Read Only, is enough. From there, the attacker can gain operator-level privileges. Arista states the issue "is known to be actively exploited" and that there is no configuration that can prevent the exposure.

The advisory lists two IP addresses seen in attacks: 74.82.197.86 and 38.54.50.151. The Hacker News, reporting the same day, notes this is the third VCO flaw Arista has reported as exploited since late July, and the first that needs a login. Arista has not said who is behind the attacks or how many organisations were hit.

Who Is Affected

VCO release (on-premises)AffectedFixed in
5.2Versions before 5.2.3.185.2.3.18 and later
6.1Versions before 6.1.3.106.1.3.10 and later
6.4Versions before 6.4.2.126.4.2.12 and later

Arista says hosted and dedicated orchestrators were also affected but have already been patched. VeloCloud Edge and Gateway devices are not listed as affected, and Arista's EOS switches and CloudVision are not affected. End-of-support releases were not assessed; Arista asks those customers to contact its support team (TAC).

What It Means for Indian Businesses and Departments

SD-WAN is widely used by Indian companies with many branches, plants, warehouses or retail outlets, and by service providers who manage networks for clients. If you run your own VCO, an attacker with any valid login, including a forgotten read-only account or a partner's account, could gain control of the management plane. From there, network policies and connected sites are exposed.

If an outside provider manages your SD-WAN, ask them directly whether they run an on-premises orchestrator and whether it has been patched. If you use a hosted orchestrator, Arista says it has already been fixed, but it is still worth reviewing who has accounts.

Organisations in India should also keep CERT-In's incident reporting rules in mind. CERT-In's April 2022 directions require certain types of cyber incidents to be reported within 6 hours of noticing them. If you find signs of compromise, check with your security and legal advisers whether reporting applies. Our CERT-In 6-hour reporting checklist explains the basics.

What to Do Now

  1. Find your orchestrator. Confirm whether you or your provider run an on-premises VeloCloud Orchestrator and note its exact version.
  2. Patch to a fixed release. Upgrade to 5.2.3.18, 6.1.3.10, 6.4.2.12 or later, following Arista's advisory and your change process.
  3. Restrict access to the web interface. Allow the VCO web interface only from trusted administrative networks, as Arista recommends.
  4. Block and search for the listed IPs. Block 74.82.197.86 and 38.54.50.151 and search firewall and web logs for past connections from them.
  5. Review accounts and admin activity. Remove unused logins, including read-only and partner accounts, and look for unexpected changes by administrators.
  6. Look for signs of compromise. Check for unknown processes, webshells, unusual outbound traffic from the VCO host and odd entries in web access logs.
  7. Preserve evidence if anything looks wrong. Keep web, application, system and database logs before cleaning up, and involve your incident response team.

For a longer-term approach to keeping network and security devices up to date, see our guide to a patch management process. If you are planning or reviewing SD-WAN for multiple sites, our article on SD-WAN for multi-branch offices in India covers design and security basics.

Frequently Asked Questions

Is my VeloCloud Edge device affected?

Arista's advisory lists VeloCloud Edge and Gateway as not affected. The flaw is in the on-premises VeloCloud Orchestrator, the central management system. Compromise of the orchestrator can still affect the sites it manages, so patch it first.

We use a hosted orchestrator. Do we need to act?

Arista says hosted and dedicated orchestrators have already been patched. It is still sensible to review user accounts and recent admin activity, and to confirm with your provider which model you are on.

Do we have to report this to CERT-In?

Having the vulnerability is not the same as having an incident. If you find signs that your systems were compromised, CERT-In's directions may require reporting within 6 hours. Check the directions and take advice from your security and legal teams.

How Affix Center Can Help

Affix Center helps enterprises and government departments in India assess exposure, patch critical systems and check for compromise. Our cybersecurity and IT operations teams can review your SD-WAN management setup, tighten access and set up monitoring. Contact our team if you need help responding to this advisory.