Arista has issued a warning about a significant SQL injection vulnerability found in its VeloCloud Orchestrator (VCO), which is the main management system for VeloCloud SD-WAN networks. This critical flaw, disclosed in an advisory on October 22, allows attackers with a valid login to escalate their privileges to operator level, granting them full control over the orchestrator.
Details of the Exploit
The vulnerability, identified as CVE-2026-114625, is a zero-day flaw that has been actively exploited. It carries a high severity score of 9.9 on the CVSS scale. This flaw affects orchestrators even if they are running releases that addressed previous vulnerabilities revealed in July and September, as those versions are outdated compared to the new fixes.
Arista acquired the VeloCloud SD-WAN product line from Broadcom in July 2025. The products were formerly known as VMware SD-WAN by VeloCloud. To exploit this flaw, an attacker needs network access to the VCO web interface and can use an Enterprise Read Only account, the lowest user role, to gain unauthorized privileges.
Impact and Mitigation
An attacker exploiting this flaw could act as a local superuser, potentially altering or disrupting the orchestrator and its managed data. While the advisory does not specify the exact targets or outcomes of the attacks, it highlights the risk of significant system compromise.
Arista has provided patches for on-premises orchestrators in versions VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12. Hosted and Dedicated orchestrators have already been updated. Until systems can be upgraded, Arista advises limiting access to the VCO interface, monitoring for unauthorized network activity, and reviewing administrator actions for discrepancies.
Security Recommendations
To further mitigate risk, customers are advised to block specific IP addresses associated with the attacks: 74.82.197[.]86 and 38.54.50[.]151. Monitoring for suspicious URL requests and high request rates is also recommended. If a compromise is suspected, evidence should be preserved before making any changes.
Although earlier vulnerabilities in July and September allowed attackers to access VeloCloud Edge devices, it is unclear whether the current flaw poses a similar threat. Arista’s advisory does not confirm if upgrading will revoke unauthorized access already gained through this flaw.
Arista emphasizes the importance of upgrading to the latest patched versions to mitigate potential security risks and safeguard network operations.
