decrypted · 28 october 2026 · vulnerabilities and patching · ai and llm security

Arista's third exploited VeloCloud zero-day in four months, and who can reach your console

Arista has patched another exploited zero-day, a flaw attackers used before a fix existed, in VeloCloud Orchestrator, the console that runs an organisation's SD-WAN. That is a software-defined WAN, the links joining your sites, managed from one central screen. SecurityWeek counts it as the third in four months. The bug matters, but the sharper UK question is who is allowed to reach that console at all.

A badge that opens too much

The flaw, CVE-2026-114625, was disclosed by Arista on 22 October. It is SQL injection. SQL is the language databases are queried in, and injection means the application mistakes text typed into a request for instructions. Arista says any logged-in user can use it to gain operator privileges and pose as a local superuser operator, reaching functions meant only for internal use. The attacker needs a valid session, but the lowest built-in role is enough.

Picture an office where a visitor's badge opens only the front door. Here, one trick at reception makes the building treat the visitor as head of security. SecurityWeek reports a severity score of 9.9 out of ten, while CISA's listing carries 9.4, so sources differ on the number.

Exposed by default

Arista says the product is vulnerable by default and no configuration change removes the flaw. It has already patched its hosted and dedicated services. Customers running it themselves must move to 5.2.3.18, 6.1.3.10 or 6.4.2.12, or later. CISA added the flaw to its KEV list, flaws known to be exploited in real attacks, on 23 October, with a deadline of 26 October for US federal agencies.

What a defender sees

Block the two addresses Arista observed attacking, 74.82.197.86 and 38.54.50.151. Check web access logs for unusual URL-like path components, encoded characters and high request rates. Review recent administrator activity. If you suspect compromise, preserve web, application, system and database logs and file timestamps before you clean up, because tidying first destroys the evidence. Arista also says to restrict the web interface to administrative networks, which is the interim fix and, I would argue, the permanent one.

The Secure by Design lesson

A management console is the master key cabinet for every branch router, so it should never be reachable from places that do not need it. Three exploited flaws in four months suggests a pattern, not bad luck, and a pattern is a design question. Two decisions would have blunted this one: a console that is private by default, and a lowest role that cannot reach anything beyond its own view.

For UK organisations the cost of applying this is modest: an inventory of every management interface, firewall rules limiting it to a few administrative addresses, and a contract clause asking suppliers what ships exposed. That is an afternoon, set against rebuilding after an attacker controls how every site connects. This is opinion, not advice, but ask your supplier one question this week: who can reach our console?

Also this week

An AI agent built to borrow other people's AI. Symantec's Threat Hunter Team published findings on 21 October about an offensive agent whose instructions were captured by an AI honeypot, a decoy posing as an unprotected AI service. The agent hunts for exposed endpoints for LLMs, the large language models behind chatbots, including self-hosted models, AI gateways and MCP servers, which are built on a standard for plugging AI assistants into other tools. It uses them without paying, a practice called LLMjacking, and treats the borrowed model as the reasoning engine that plans the attack while its own modules scan, exploit and mine cryptocurrency.

The numbers are worth reading with care. The captured instructions allowed up to 100,000 unattended steps and defined about 74 tools, with exploit modules for frameworks including Django, Jupyter, Laravel, Supabase, Next.js and Flask, per The Register. Infosecurity Magazine reports the honeypot logged over 127,000 external requests, but those were interactions with a decoy, not confirmed attacks. Crucially, the honeypot never ran the attacker's tools, so real-world impact is unproven, and Symantec says none of the individual techniques are new. The Register reports no attribution to any person or group.

The Secure by Design reading is plain. An AI endpoint that answers anyone who asks, without authentication, is a door left open, much as exposed databases were for years. Any UK organisation that has stood up a test model, a gateway or an MCP server for a pilot should check whether it is reachable from the internet, whether it demands a key, and whether anyone would notice a spike in usage. Stolen compute is a cost; a hijacked model with access to your data is a breach. That second point is my inference, not Symantec's finding, and the fix is the old one: authenticate by default, and keep pilots off the public internet.

Sources

If you want help working out what your own systems expose, get in touch.