Arista Networks has reported a critical vulnerability, CVE-2026-114625, affecting its VeloCloud Orchestrator (VCO) products, with confirmed exploitation in the wild as of October 22, 2026. The vulnerability impacts versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12, prompting urgent attention from users and administrators.
MIDDLE EAST RELEVANCE
While the advisory does not specify any incidents in the UAE or broader Middle East, organizations using Arista Networks’ VeloCloud Orchestrator should be aware of this vulnerability. The potential for exploitation could affect regional operations, particularly for those relying on this technology for network management.
KEY FACTS
- CVE-2026-114625 is actively exploited in the wild.
- Affected versions include VeloCloud Orchestrator prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12.
- The Cybersecurity and Infrastructure Security Agency (CISA) added this CVE to its Known Exploited Vulnerabilities Database on October 23, 2026.
TECHNICAL CONTEXT
CVE-2026-114625 affects the VeloCloud Orchestrator, a critical component for managing cloud-delivered SD-WAN services. The specific technical details regarding the vulnerability’s mechanism have not been disclosed, but its active exploitation indicates a significant risk for organizations using affected versions. Users are advised to monitor for updates and apply patches as they become available.
RISK AND DECISION
Organizations utilizing Arista Networks’ VeloCloud Orchestrator must prioritize immediate action to mitigate risks associated with CVE-2026-114625. The confirmed exploitation in the wild necessitates a review of current deployments and potential vulnerabilities within their network infrastructure. IT teams should assess their systems against the affected versions and prepare for patching as soon as updates are released.
DEFENSIVE GUIDANCE
Users and administrators of VeloCloud Orchestrator should verify their current software versions against the listed affected versions and prepare to implement updates once they are available. Continuous monitoring for advisories from Arista Networks and CISA is essential to ensure timely remediation of this vulnerability.
Source and evidence
The information in this report is based on the Arista Networks security advisory (AV26-1080) published by the Canadian Centre for Cyber Security on October 23, 2026. The advisory details the vulnerability and its implications for users of the VeloCloud Orchestrator.
CWME will continue tracking regional implications as more verified information becomes available.
Follow Cyber Warriors Middle East for further cybersecurity resources, advisories and technical guidance.
