Attackers exploit Arista VeloCloud Orchestrator flaw to gain operator rights

What happened

Attackers are abusing a flaw in on-premises installations of Arista's VeloCloud Orchestrator (VCO). Any user with a login can raise their rights to operator level and pose as a local superuser operator account. That account can reach functions meant only for internal use, which were never supposed to be reachable over the network.

The weakness lies in how the orchestrator builds database queries from user input. Taking over the operator role puts the orchestrator itself, the host it runs on and the data it manages at risk of being read, altered or knocked offline.

Arista has published a security advisory. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 23 October 2026.

Who is affected

On-premises installations of Arista VeloCloud Orchestrator in three release lines are affected: 5.2.0 up to but not including 5.2.3.18, 6.1.0 up to but not including 6.1.3.10, and 6.4.0 up to but not including 6.4.2.12.

Hosted VCO, including Dedicated instances, was also affected. Arista has already patched those, so hosted customers do not need to act.

How serious is it

Arista rates the flaw 9.4 out of 10 under CVSS 4.0, a critical score. An attacker needs only an ordinary user account, and no action from anyone else is required. Because the orchestrator centrally manages network equipment and data, a compromise reaches well beyond the server itself.

The flaw is under active attack. CISA set 26 October 2026 as the deadline for US federal agencies to apply Arista's mitigations or stop using the product.

What you should do

1. 1Update on-premises VeloCloud Orchestrator to 5.2.3.18, 6.1.3.10 or 6.4.2.12, depending on your release line.
2. 2Follow the mitigation guidance in Arista's security advisory.
3. 3Review which user accounts can log in to the orchestrator.
4. 4Treat any unpatched on-premises orchestrator as possibly compromised and check it for signs of misuse.

Quick facts