Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks

VeloCloud Orchestrator, or VCO, is the central management system for VeloCloud SD-WAN networks. Operators use it to create customer and partner accounts. Partners can then manage groups of customers. This makes VCO a critical control point rather than just another network server.

VCO manages access and administration across geographically distributed SD-WAN environments. The article says an attacker who reaches its web interface and logs in can exploit the flaw, even with an Enterprise Read Only account. The attacker can become a local superuser with full access to VCO.

That level of control could affect the orchestrator itself and the data it manages. The article also says the attacker may expose, modify, or disrupt the VCO host and its data. Hosted and Dedicated orchestrators have already been patched, while on-premises customers must install the listed fixed releases. The system's central role makes prompt protection important.

A SQL injection vulnerability occurs when an application unsafely combines user-provided input with database commands. An attacker can submit specially crafted input that changes how the database interprets a request. Depending on the flaw and the application's permissions, this can expose, alter, or delete data, or affect authentication and authorization decisions.

The article identifies the VCO issue as a zero-day SQL injection flaw. It does not describe the exact query, endpoint, or database operation involved. It does state that a valid VCO login is enough to exploit it, and that the minimum role is Enterprise Read Only, the lowest built-in customer role.

The practical result is severe: the attacker can gain operator privileges and act as a local superuser. The vulnerability is tracked as CVE-2026-114625 and rated 9.9 on CVSS. Administrators should install the appropriate fixed release and review logs for unusual requests, encoded characters, internal-service references, or high request rates.

Enterprise Read Only is the lowest built-in role for customer users. Normally, that role would provide limited access rather than administrative control. The flaw breaks that boundary. An attacker still needs network access to the VCO web interface and a valid login, but does not need an operator account.

The article identifies the weakness as SQL injection and says it lets anyone who can log in gain operator privileges. It does not provide the exact malicious request or database query. Its key finding is the outcome: the attacker can act as a local superuser, which is VCO's role with full access.

This matters because customer credentials may be much easier to obtain or misuse than operator credentials. VCO is exposed by default, and no VCO setting prevents that exposure. Until upgrading, administrators should restrict the web interface to trusted administrative networks, monitor suspicious activity, and review administrator changes for signs of unauthorized access.

A CVSS score of 9.9 indicates a critical-severity vulnerability under the Common Vulnerability Scoring System. It signals that the flaw could have extremely serious consequences, although the score does not describe every condition of an attack. Here, exploitation still requires network access to VCO's web interface and a valid login.

Arista says the flaw is being exploited and tracks it as CVE-2026-114625. It is the third VCO vulnerability the company has reported as exploited since late July. The July flaw, CVE-2026-16812, and September flaw, CVE-2026-93952, did not require a login. The new flaw is the first of the three that does.

The risk is heightened because affected older releases remain vulnerable even if they fixed the July and September issues. On-premises customers need a release-specific update. Hosted and Dedicated orchestrators have already been patched. Administrators should also investigate the two attacker IP addresses and unusual web requests.

Gaining operator privileges gives an attacker the highest level of control over VCO. The flaw allows a logged-in attacker to act as a local superuser. The article describes that role as having full access, so the compromise can extend well beyond the permissions of the original customer account.

The advisory says an attacker may affect the VCO host itself. It may also allow the attacker to expose, modify, or disrupt the orchestrator and the data it manages. The article does not state exactly what actions attackers took after exploitation, which orchestrators were hit, or when the attacks began.

Administrators should treat a suspected compromise as a broader host incident. Arista recommends watching for unexpected outbound activity, backdoor daemons, webshells, and administrator changes. Before fixing a suspected compromise, preserve web access, application, system, and database logs, plus relevant file-system timestamps, where possible.

The listed on-premises VCO releases are vulnerable unless updated to the matching fixes: 5.2.3.18, 6.1.3.10, or 6.4.2.12. Hosted and Dedicated orchestrators have already been patched. VeloCloud Gateway and VeloCloud Edge are not affected, and the 7.0 release train is not listed as vulnerable.

Arista warns that releases fixing the July and September VCO flaws can still be exposed because they are older than these new fixes. The company has not checked releases that reached end of support. Customers on unsupported trains should contact Arista's Technical Assistance Center about upgrade options.

Until upgrading, limit VCO web access to trusted administrative networks. Block unnecessary outbound ports and monitor malicious IP addresses, unexpected outbound traffic, webshells, backdoor daemons, and unusual administrator activity. Check logs for the listed IP addresses and suspicious URL-like paths, encoded characters, internal-service references, or high request rates.

SD-WAN connects and manages network links across geographically distributed sites through software-based policies and centralized administration. The article focuses on VCO as the central management system for VeloCloud SD-WAN networks. That central position lets operators administer customers, partners, and groups of customer environments from one place.

For example, VCO operators create customer and partner accounts, while each partner can manage a group of customers. An attacker who reaches VCO's web interface and logs in with Enterprise Read Only can exploit the flaw and become a local superuser. The attacker therefore crosses from one limited account into full orchestrator control.

Centralization improves consistency and administration, but it also concentrates risk. The article says the attacker may affect the VCO host and the data it manages. It does not say whether this flaw also grants access to VeloCloud Edge devices, a risk mentioned for the earlier July and September flaws. Patching and restricting access are therefore key defenses.