CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on 23 October 2026, with a remediation due date of 26 October for federal agencies. The flaw is a SQL injection in the on-prem VeloCloud Orchestrator (VCO), the management console for VeloCloud SD-WAN (formerly VeloCloud by Broadcom, now Arista). Arista's Security Advisory 0199 (22 October) rates it CVSS 3.1 9.9 and says it was detected by Arista and is known to be actively exploited.
According to Arista, any authenticated VCO user, down to the lowest built-in tenant role (Enterprise Read Only), can gain operator privileges and act as a local "superuser operator," including functions meant for internal use only. Arista says there is no configuration that prevents the exposure. Affected releases are VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12. Hosted and dedicated VCO instances have already been patched by Arista, and VeloCloud Edges and Gateways are not affected. CISA has flagged the entry for forensic triage, so the expectation is to look for compromise, not just patch.
Why this matters for OT owners: SD-WAN is how a lot of utilities, pipelines, water systems and multi-site manufacturers tie remote sites together. Lift stations, well pads, compressor stations, substations and plants often reach the control center or the cloud through an SD-WAN edge. The orchestrator pushes configuration and routing to every one of those edges. Whoever controls the orchestrator controls the paths into those sites, so an exploited VCO is a network-wide problem, not a single server issue.
Where it shows up, plant floor to cloud: the field devices and PLCs at a remote site sit behind a local firewall and an SD-WAN edge; the edge builds tunnels back to the control center, the corporate network and cloud services; the on-prem VCO, usually in a corporate data center or DMZ, defines those tunnels, segments and policies for every site.
What the Red Tiger team recommends:
1. Find out if you run an on-prem VCO, including one managed for you by a telecom provider or integrator, and upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later now. If you use hosted VCO, confirm with your provider that the patch is in place.
2. Until you are patched, restrict the VCO web interface to trusted administrative networks, and block the two source IP addresses Arista published in its advisory.
3. Hunt before you clean up. Preserve VCO web, application, system and database logs, then review recent administrator activity, user and role changes, and any configuration pushed to edges, and watch for unexpected outbound traffic from the VCO host.
4. Check what an orchestrator change could reach. Confirm that segments and policies keep OT traffic separated from IT and guest traffic, and that a site firewall still sits between the SD-WAN edge and the control network.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources: Arista Security Advisory 0199: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Check out our resources and book a follow-up call with our team.
