Arista — Critical VeloCloud SQL Injection Zero-Day Exploited in Active Attacks (CVE-2026-114625)

Publication date: October 22, 2026
Category: Vulnerability / Enterprise Security

Introduction

Arista Networks has issued urgent security advisories following the detection of active, in-the-wild exploitation targeting a critical zero-day SQL injection vulnerability within VeloCloud Orchestrator (VCO), the core management platform for enterprise SD-WAN networks. Tracked as CVE-2026-114625, the flaw enables any authenticated user—including those possessing standard read-only customer accounts—to escalate privileges and impersonate a local “superuser operator,” granting complete control over the on-premises orchestrator and its managed edge infrastructure. This incident marks the third severe flaw reported in the platform over recent months, underscoring an ongoing threat campaign targeting enterprise network control planes.

What is VeloCloud Orchestrator? (General Analysis)

VeloCloud Orchestrator (VCO) functions as the centralized control plane and administrative console for enterprise SD-WAN architectures, enabling mass provisioning, configuration, and monitoring of VeloCloud Edge appliances and gateways. Because the orchestrator holds absolute administrative governance over multi-tenant branch connectivity and perimeter security, any compromise of its core services poses catastrophic organizational risks.

Official data from the National Vulnerability Database (NVD) classifies the flaw in CVE-2026-114625 as an SQL Injection under CWE-89. The official CVSS v4.0 score is rated at 9.4 (CRITICAL) (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), indicating that a remote attacker with valid low-privileged credentials can fully compromise the confidentiality, integrity, and availability of both the orchestrator host and all managed tenant data.

How Does It Work? (Technical Analysis)

The exploitation vector relies on inadequate input validation and improper handling of database queries within the orchestrator backend components.

• Initial Access Vector: The attacker requires network connectivity to the orchestrator’s web interface alongside valid user credentials. The entry barrier is exceptionally low since the minimum required role is Enterprise Read Only (the default baseline customer role), and VCO instances are frequently exposed to external networks by default.
• Privilege Escalation & Execution: By leveraging the SQL injection flaw, an attacker bypasses application-level access control barriers, manipulating backend database transactions to inherit operator-level privileges. This grants them the capabilities of a local superuser, unlocking internal administrative functionalities never intended for remote exposure.
• Host & Ecosystem Impact: Once full operator privileges are acquired, the adversary can manipulate SD-WAN configurations, intercept tenant data streams, establish persistent footholds, and potentially pivot toward connected VeloCloud Edge devices across the managed enterprise footprint.

Affected Systems / Environments

Impacted configurations include all on-premises VeloCloud Orchestrator deployments running software versions preceding the official patches. Hosted and Dedicated instances managed by Arista have already received automated remediation.

Specific patched release trains for on-premises deployments comprise:

• 5.2 Train: Fixed in 5.2.3.18 and later.
• 6.1 Train: Fixed in 6.1.3.10 and later.
• 6.4 Train: Fixed in 6.4.2.12 and later.

Mitigation and Detection

Remediation

• Immediately upgrade on-premises VeloCloud Orchestrator installations to the patched version trains (5.2.3.18, 6.1.3.10, 6.4.2.12, or later).
• Restrict network exposure of the VCO web interface strictly to trusted administrative network segments using perimeter firewalls or VPN tunnels.
• Audit administrative accounts regularly to identify and revoke unauthorized or newly created privileged entities.

Detection

Defensive teams must actively review web access logs and system telemetry for exploitation indicators:

Defensive Intelligence Note: Exploitation attempts manifest as HTTP requests interacting with internal backend application paths. Security teams should inspect logs for unusual encoded characters, SQL syntax markers (such as UNION statements or parameter manipulation), and high request rates originating from baseline read-only accounts.

• Indicators of Compromise (IoCs): External IP addresses observed orchestrating active attacks against VCO deployments include:
  • 74.82.197[.]86
  • 38.54.50[.]151
• Forensic Preservation: Prior to applying patches, capture volatile evidence including VCO web access logs, backend application logs, database traces, system logs, and relevant filesystem timestamps.

Wrapping Up

The emergence of critical zero-day vulnerabilities in central orchestration platforms like Arista VeloCloud Orchestrator highlights the systemic risks associated with SDN and perimeter network management layers. The compounding exploitation of SQL injection and command execution flaws demands immediate patch deployment and strict network segmentation to safeguard enterprise infrastructure against advanced persistent threats.

References

• Arista Networks. (2026). Security Advisory 0199: VeloCloud Orchestrator On-Premises SQL Injection Vulnerability. https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
• Arista Networks. (2026). Security Advisory 0183: VeloCloud Orchestrator Security Notice. https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
• Arista Networks. (2026). Security Advisory 0144: VeloCloud Orchestrator Critical Flaw. https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144
• Cybersecurity and Infrastructure Security Agency (CISA). (2026). Known Exploited Vulnerabilities Catalog (CVE-2026-16812, CVE-2026-93952). https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812
• Arista Networks. (2025). VeloCloud SD-WAN 6.4 Operator Guide. https://www.arista.com/assets/data/pdf/qsg/VC-SD-WAN-6.4-Operator-Guide.pdf
• Khandelwal, S. (2026). Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks. The Hacker News. https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html