Ethical Hacking News
U.S. CISA adds a critical Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog, alerting network administrators to a high-severity SQL Injection issue that could compromise system and data security. The advisory advises administrators to monitor web access logs and block suspicious IP addresses to prevent potential attacks.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw in Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities (KEV) catalog with a CVSS score of 9.4. The flaw allows an authenticated user to gain operator privileges and impersonate a local superuser operator account, potentially compromising the system and data it manages. VeloCloud Orchestrator is vulnerable by default, requiring only access to the web interface and a valid account to exploit. Administrators are advised to monitor web access logs for unusual requests and block IP addresses linked to attacks. Federal agencies have until October 26, 2026, to address the vulnerability, and private organizations are recommended to do so as well.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added a critical flaw in the Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2026-114625, has a CVSS score of 9.4, indicating a high level of severity. This addition serves as a warning to network administrators to address the vulnerability in their infrastructure to prevent potential attacks.
Arista VeloCloud Orchestrator (VCO) is the central management system for VMware SD-WAN, a technology that helps companies securely connect offices, data centers, cloud services, and remote sites over wide-area networks. VCO is now associated with Arista Networks, which acquired VMware's SD-WAN business. The orchestrator provides network administrators with a central place to configure, monitor, and manage the network.
The critical flaw discovered in VCO allows an authenticated user to gain operator privileges and impersonate a local superuser operator account. This could give a remote attacker access to internal functions that should not be remotely available, potentially compromising the system and the data it manages. Hosted VCO versions, including Dedicated, were also affected but have already been patched.
According to the advisory, VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
VeloCloud Orchestrator (VCO) is vulnerable by default. An attacker needs access to its web interface and a valid account. Even an account with the lowest permission level, Enterprise Read Only, is enough. No configuration change can prevent this exposure.
Administrators are advised to check web access logs for unusual requests, encoded text, attempts to access internal services, or an unusually high number of requests. They should also block these IP addresses linked to attacks:
74.82.197.86
38.54.50.151
If an attack is suspected, administrators should save web, application, system, and database logs, along with relevant file timestamps, before starting recovery, if possible.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, federal agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the flaw by October 26, 2026.
Related Information:
https://www.ethicalhackingnews.com/articles/US-CISA-Adds-Arista-VeloCloud-Orchestrator-Flaw-to-its-Known-Exploited-Vulnerabilities-Catalog-A-Critical-Alert-for-Network-Administrators-ehn.shtml
https://securityaffairs.com/201609/hacking/u-s-cisa-adds-arista-velocloud-orchestrator-flaw-to-its-known-exploited-vulnerabilities-catalog.html
https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
https://nvd.nist.gov/vuln/detail/CVE-2026-114625
https://www.cvedetails.com/cve/CVE-2026-114625/
Published: Sat Oct 24 04:08:24 2026 by llama3.2 3B Q4_K_M
