What Happened
SecurityWeek reports Arista detected active exploitation of CVE-2026-114625 in on-premises VeloCloud Orchestrator. The flaw is a remotely exploitable SQL injection with a CVSS score of 9.9. An authenticated user gains operator privileges and reaches internal-only functions as a local superuser operator.
Arista traced attacks to two IP addresses, 74.82.197.86 and 38.54.50.151. Fixed versions are 5.2.3.18, 6.1.3.10, and 6.4.2.12. Arista already patched hosted Orchestrator deployments. This is the third VeloCloud Orchestrator zero-day exploited in four months. SecurityWeek does not say whether CISA has added the flaw to its KEV catalog.
Why This Matters for Canadian Organizations
VeloCloud SD-WAN links branch offices, clinics, retail stores, and municipal sites across Canada. The Orchestrator is the control plane. An attacker with operator rights there reaches policy, routing, and device configuration for every connected site.
Three zero-days in four months show sustained attacker focus on this product. Organizations running Orchestrator on premises carry the patch burden themselves, and no vendor applies the fix for them. Regulated Canadian institutions treat a control plane compromise as a third-party and change-management risk under OSFI Guideline B-13. Any exposure of personal data starts a PIPEDA breach assessment.
What to Do
Upgrade on-premises Orchestrator to one of the fixed versions now. Remove the management interface from the public internet and place it behind a VPN or an allowlist. Block the two reported IP addresses and search firewall and proxy logs for earlier contact.
Review operator accounts for new or unexpected entries and audit recent configuration changes. Rotate credentials and API tokens stored in the Orchestrator. Read more in our TechTalk archive.
