The facts

  1. Exploitation requires network access to Orchestrator and a valid session. Arista says even an Enterprise Read Only tenant role can be sufficient. [1]

  2. For supported on-premises release lines, the affected versions precede 5.2.3.18, 6.1.3.10 and 6.4.2.12. Arista identifies those respective releases as fixes; unassessed, unsupported versions should not be assumed safe. [1]

  3. Arista says its hosted Orchestrator services, including dedicated deployments, have been patched. Customers operating their own instances need to apply the appropriate vendor fix. [1]

  4. The vendor also recommends restricting web access to trusted administrative networks and preserving relevant logs where compromise is suspected. Access restrictions do not replace patching. [1]

Still unconfirmed

  • The number of compromised organizations and the attackers’ identities are not established in the checked sources.

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 11:28 UTC.

  1. Security Advisory 0199: VeloCloud Orchestrator SQL injection

    Arista Networks · Primary source · 22 Oct 2026

    Actual advisory read for authentication requirements, affected release trains, fixed versions, hosted-service status and confirmed exploitation.

  2. Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

    BleepingComputer · Reporting · 22 Oct 2026

    Sergiu Gatlan’s actual report was opened. Separately owned from Arista; exploitation and version claims derive from the vendor, not an independent count of victims.

Report a factual error