Arista VeloCloud Orchestrator: an exploited SQL injection turns a read-only account into an operator

Arista has fixed CVE-2026-114625, a SQL injection in the on-premises VeloCloud Orchestrator that lets a user with the lowest role take operator privileges over the SD-WAN management platform. The vendor says the flaw is actively exploited, and CISA has given US agencies until 26 October to act.

What happened

On 22 October 2026, Arista published Security Advisory 0199 for CVE-2026-114625, a SQL injection in VeloCloud Orchestrator (VCO), the console that manages VeloCloud SD-WAN edges. The vendor rates it 9.9 under CVSS 3.1 (9.4 under CVSS 4.0) and states that it detected the issue itself and that it is actively exploited. CISA added it to its catalogue of exploited vulnerabilities on 23 October, with a deadline of 26 October for US federal agencies and a forensic triage requirement.

Who is affected and how attackers get in

Only on-premises orchestrators are vulnerable: VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12. Hosted and Dedicated instances have already been patched by Arista, and EOS switches, CloudVision and the edge devices themselves are not affected. Any authenticated user, even one with the Enterprise Read Only role, can gain operator rights, pose as an internal superuser and reach functions that were never meant to be remotely accessible, with potential impact on the VCO host and on the data it manages. Since the orchestrator pushes configuration to every site, its compromise affects the whole network.

What to do now

1. Check the version of each on-premises orchestrator in its web interface and compare it with the list above.
2. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later, depending on your branch.
3. Restrict access to the VCO web interface to trusted administration networks until the update is installed.
4. Search the web access logs for the two addresses published by Arista, 74.82.197[.]86 and 38.54.50[.]151, and for unusual paths, encoded characters, references to local services or bursts of requests.
5. Look for persistence: webshells, backdoors, unexpected outbound connections from the orchestrator and recent administrator actions; review the list of accounts and remove unused read-only accesses.

Our take

A read-only account is often handed out freely, to a provider or an auditor, because it is considered harmless; this flaw shows that on a management console, every account is a potential way in. Network orchestrators deserve the same treatment as firewalls: isolated administration network, multi-factor authentication, regular account reviews and fast patching.

Sources

• Arista — Security Advisory 0199: VeloCloud Orchestrator
• CISA — Known Exploited Vulnerabilities Catalog: CVE-2026-114625
• NIST NVD — CVE-2026-114625 Detail

How we choose, verify and write our analyses →