On-premises VeloCloud Orchestrator servers running the builds Arista shipped last month need another update. Arista Networks disclosed a new actively exploited flaw in the SD-WAN management portal on Thursday, and the September fixes fall short of the new fixed releases.

The bug, CVE-2026-114625 , is a SQL injection flaw rated 9.9 on CVSS 3.1 and 9.4 on CVSS 4.0. Any authenticated user can use it to gain operator privileges and pose as a local “superuser operator,” which opens functions Arista says were meant for internal use only and were never supposed to be reachable remotely. Arista found the problem itself and said it is being exploited in the wild. Its hosted and Dedicated orchestrators were also affected and have already been patched.

On-premises customers need VCO 5.2.3.18, 6.1.3.10 or 6.4.2.12, or later builds in those trains. The September fixes for CVE-2026-93952 were 5.2.3.16 and 6.4.2.8, both below the new cutoffs.…