--- title: "Arista patches a third exploited VeloCloud zero-day, a CVSS 9.9, eight days before its November 3 earnings" description: "Arista patched a CVSS 9.9, actively exploited SQL injection in VeloCloud Orchestrator on October 22, the third zero-day in the acquired line in four months, eight days before earnings. The selloff priced AI financing anxiety; it has not yet priced the security pattern." publisher: "The Inference" section: "Security" published: 2026-10-24T16:07:18.100Z modified: 2026-10-24T16:07:18.100Z canonical: https://theinference.org/article/arista-patches-a-third-exploited-velocloud-zero-day-a-cvss-9-9-eight-days-before-its-november-3-earnings language: en keywords: "Arista Networks, VeloCloud, Zero Day, Cybersecurity, Earnings" --- # Arista patches a third exploited VeloCloud zero-day, a CVSS 9.9, eight days before its November 3 earnings > Arista patched a CVSS 9.9, actively exploited SQL injection in VeloCloud Orchestrator on October 22, the third zero-day in the acquired line in four months, eight days before earnings. The selloff priced AI financing anxiety; it has not yet priced the security pattern. [Arista](https://theinference.org/markets/companies/arista-networks) patched a third actively exploited VeloCloud zero-day on Thursday, and the market is not pricing the pattern. The stock has already fallen about 13% in the week ending October 19, closing at $172.37 on October 23 after [a 7.22% single-day drop on October 22](https://www.tradingkey.com/news/market-movers/262232985-market-movers-anet-20261022), but the selling has been attributed to AI financing fears, [insider-selling overhang](https://theinference.org/article/arista-faces-a-9-7-billion-parts-bill-after-insiders-sold-740-8-million-of-stock) and valuation anxiety, not to a security record that keeps repeating [2][3]. Before the November 3 earnings test, the pattern itself is information [2][3]. ## What the flaw gives an attacker The flaw, CVE-2026-114625, is a CVSS 9.9 SQL injection in VeloCloud Orchestrator on-premises, the centralized management platform for VeloCloud SD-WAN branch networks, a line Arista bought from [Broadcom](https://theinference.org/markets/companies/broadcom) in 2025 [1][5]. Arista says any authenticated user can become a superuser operator, that on-prem deployments are exposed by default, and that "there is no configuration that can prevent the exposure" [1]. It is the third exploited VCO zero-day in four months: CVE-2026-16812 in July, CVE-2026-93952 in September, and this one [1]. The July flaw was worse in one respect: an unauthenticated command injection rated the maximum 10.0, needing no credentials at all, and [CISA added it to its Known Exploited Vulnerabilities catalog](https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/) [4]. Three exploited zero-days in the same management product in four months is a repeatable quality gap, not a one-off defect. ## Why the reach extends beyond the WAN Here is the chain of compromise. VCO holds the configuration data, device inventories, credentials, certificates and cryptographic keys for the branch edge devices it manages, and [Arista's own advisory warns](https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/) that compromising the orchestrator can give attackers access to those VeloCloud Edge devices as well [1][4]. One flaw in the management plane therefore reaches every branch it controls. That is a different product tier from Arista's core network operating system, the single-image software that carries its AI data center premium. But the buyers of that premium and the buyers of the WAN management plane are the same institutions, and the gap sits in Arista's own acquired tooling rather than in the silicon race. Closing it is ordinary engineering work, and Arista is visibly still doing it. *Chart: **The largest daily drop of the selloff came the day the third zero-day was patched** Column chart of ANET's four reported daily declines in October 2026: 4.5 percent on October 14, 5 percent on October 15, 4.6 percent on October 16 and 7.22 percent on October 22.* *The largest daily drop of the selloff came the day the third zero-day was patched [2][3]* ## What to watch on November 3 For investors, the demand math is unchanged: [revenue grew 37.7% year over year to $3.036 billion last quarter](https://finance.yahoo.com/markets/stocks/articles/arista-just-dropped-13-week-234748327.html), [Microsoft](https://theinference.org/markets/companies/microsoft) and [Meta](https://theinference.org/markets/companies/meta) alone contribute over 40% of revenue, and the selloff came from AI financing anxiety and insider sales rather than Arista's balance sheet [2][3]. The security record is the variable the November 3 print will not report [2][3]. Watch two things: whether hyperscaler capex commentary and guidance stay strong enough to support the consensus growth path, and whether management is asked about, and accounts for, the VCO patch cadence. If demand guidance holds, the drawdown looks like a market pricing financing fears twice and the security pattern not at all; if guidance slips, the security record stops being a footnote and becomes a reason the premium multiple does not come back quickly. ## Takeaway Arista's third exploited VeloCloud zero-day in four months, a CVSS 9.9 patched October 22, is a security pattern the market's AI-financing-driven selloff has not priced ahead of November 3 earnings. ## Sources 1. [SecurityWeek, Attackers Exploit Third Arista VCO Zero-Day in Four Months, 23 October 2026](https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/) 2. [Yahoo Finance, Arista Just Dropped 13% in a Week. Is It Time to Sell, or Load Up?, 23 October 2026](https://finance.yahoo.com/markets/stocks/articles/arista-just-dropped-13-week-234748327.html) 3. [TradingKey, Arista Networks Inc Stock (ANET) Moved Down by 7.22% on Oct 22, 22 October 2026](https://www.tradingkey.com/news/market-movers/262232985-market-movers-anet-20261022) 4. [BleepingComputer, Arista patches VeloCloud Orchestrator zero-day exploited in attacks, 27 July 2026](https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/) 5. [TechTarget, Arista buys VeloCloud from Broadcom, 2 July 2025](https://www.techtarget.com/it-infrastructure/news/366627055/Arista-buys-VeloCloud-from-Broadcom) --- Arista patches a third exploited VeloCloud zero-day, a CVSS 9.9, eight days before its November 3 earnings — The Inference. Canonical: https://theinference.org/article/arista-patches-a-third-exploited-velocloud-zero-day-a-cvss-9-9-eight-days-before-its-november-3-earnings