Arista has released fixes for a critical flaw in VeloCloud Orchestrator, the management system for many business SD-WAN networks, after confirming attackers are already using it in real attacks.

• What it is: a critical privilege escalation flaw (reported as CVE-2026-114625) that lets any logged-in user gain operator-level control of the orchestrator.
• Who is affected: organisations running VeloCloud Orchestrator On-Prem, including IT providers who manage branch networks on behalf of clients.
• The risk: an attacker with control of the orchestrator could change network settings, view data it manages and disrupt connectivity across sites.
• What to do: update to version 5.2.3.18, 6.1.3.10 or 6.4.2.12 (or later), restrict access to the management web interface to administrative networks, and review web access logs and recent administrator activity for anything unusual.

If you use VeloCloud and are unsure which version you are running, contact us and we will check it for you. Source: BleepingComputer.