Arista patches a third exploited VeloCloud zero-day, a CVSS 9.9, eight days before its November 3 earnings
Arista patched a CVSS 9.9, actively exploited SQL injection in VeloCloud Orchestrator on October 22, the third zero-day in the acquired line in four months, eight days before earnings. The selloff priced AI financing anxiety; it has not yet priced the security pattern.
Richard Tang · 3 min read
Arista+0.60% — Arista, up 0.60 percent today patched a third actively exploited VeloCloud zero-day on Thursday, and the market is not pricing the pattern. The stock has already fallen about 13% in the week ending October 19, closing at $172.37 on October 23 after a 7.22% single-day drop on October 22, but the selling has been attributed to AI financing fears, insider-selling overhang and valuation anxiety, not to a security record that keeps repeating 23. Before the November 3 earnings test, the pattern itself is information 23.
What the flaw gives an attacker
The flaw, CVE-2026-114625, is a CVSS 9.9 SQL injection in VeloCloud Orchestrator on-premises, the centralized management platform for VeloCloud SD-WAN branch networks, a line Arista bought from Broadcom−0.45% — Broadcom, down 0.45 percent today in 2025 15. Arista says any authenticated user can become a superuser operator, that on-prem deployments are exposed by default, and that "there is no configuration that can prevent the exposure" 1.
It is the third exploited VCO zero-day in four months: CVE-2026-16812 in July, CVE-2026-93952 in September, and this one 1. The July flaw was worse in one respect: an unauthenticated command injection rated the maximum 10.0, needing no credentials at all, and CISA added it to its Known Exploited Vulnerabilities catalog 4. Three exploited zero-days in the same management product in four months is a repeatable quality gap, not a one-off defect.
Why the reach extends beyond the WAN
Here is the chain of compromise. VCO holds the configuration data, device inventories, credentials, certificates and cryptographic keys for the branch edge devices it manages, and Arista's own advisory warns that compromising the orchestrator can give attackers access to those VeloCloud Edge devices as well 14. One flaw in the management plane therefore reaches every branch it controls.
That is a different product tier from Arista's core network operating system, the single-image software that carries its AI data center premium. But the buyers of that premium and the buyers of the WAN management plane are the same institutions, and the gap sits in Arista's own acquired tooling rather than in the silicon race. Closing it is ordinary engineering work, and Arista is visibly still doing it.
The largest daily drop of the selloff came the day the third zero-day was patched
Data
| ANET daily move | |
|---|---|
| Oct 14 | -4.5% |
| Oct 15 | -5% |
| Oct 16 | -4.6% |
| Oct 22 | -7.22% |
What to watch on November 3
For investors, the demand math is unchanged: revenue grew 37.7% year over year to $3.036 billion last quarter, Microsoft+0.64% — Microsoft, up 0.64 percent today and Meta−1.36% — Meta, down 1.36 percent today alone contribute over 40% of revenue, and the selloff came from AI financing anxiety and insider sales rather than Arista's balance sheet 23. The security record is the variable the November 3 print will not report 23.
Watch two things: whether hyperscaler capex commentary and guidance stay strong enough to support the consensus growth path, and whether management is asked about, and accounts for, the VCO patch cadence. If demand guidance holds, the drawdown looks like a market pricing financing fears twice and the security pattern not at all; if guidance slips, the security record stops being a footnote and becomes a reason the premium multiple does not come back quickly.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
