Arista VeloCloud Orchestrator Hit by Critical SQL Injection Zero-Day
Arista has issued a warning about a critical zero-day SQL injection vulnerability in its VeloCloud Orchestrator (VCO) that is actively being exploited.
Arista has alerted customers to a critical zero-day SQL injection vulnerability affecting its VeloCloud Orchestrator (VCO), the central management platform for VeloCloud SD-WAN networks. The flaw, tracked as CVE-2026-114625 and rated with a CVSS score of 9.9, allows attackers with even read-only access to escalate their privileges to operator level, granting them full control over the orchestrator.
Exploitation requires network access to the orchestrator's web interface and a valid login, with the minimum required role being Enterprise Read Only. Arista notes that VCO is exposed by default, and no existing settings prevent this exposure. Once an attacker gains operator privileges, they can act as a local superuser, potentially affecting the VCO host itself, exposing, modifying, or disrupting the orchestrator and its managed data.
This marks the third exploited vulnerability in VCO since late July, but it is the first that necessitates a login. Previous flaws, CVE-2026-16812 (July) and CVE-2026-93952 (September), did not require authentication. Arista has provided specific patched versions for on-premises orchestrators: VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12. Hosted and Dedicated orchestrators have already been patched.
Arista acquired the VeloCloud SD-WAN product line from Broadcom in July 2025; the products were previously known as VMware SD-WAN by VeloCloud. The advisory does not specify when the attacks began, which orchestrators have been compromised, or the extent of the attackers' actions post-exploitation.
For organizations unable to upgrade immediately, Arista recommends limiting access to the VCO web interface to trusted administrative networks, monitoring VCO for suspicious connections from known malicious IP addresses (74.82.197[.]86 and 38.54.50[.]151), and watching for unexpected outbound network activity from the VCO host. Blocking unnecessary outbound ports and monitoring for backdoor daemons and webshells are also advised.
Additionally, Arista suggests reviewing recent administrator activity for any unusual changes. If a compromise is suspected, it is crucial to preserve evidence, including VCO web access logs, backend application logs, system and database logs, and relevant file-system timestamps, before attempting remediation.
While the advisory for this specific flaw does not explicitly state whether it extends the risk to VeloCloud Edge devices, previous advisories for July and September flaws indicated that a compromised orchestrator could grant attackers access to these edge devices. The impact on existing unauthorized access post-upgrade remains unclear for this new vulnerability.
Arista has not verified releases that have reached end-of-support. Customers running unsupported versions are advised to contact Arista's Technical Assistance Center (TAC) to discuss upgrade options. The company also notes that release trains not listed in the advisory are not considered vulnerable.