Arista VeloCloud Orchestrator Crippled by Critical SQL Injection Zero-Day (CVE-2026-114625)

Overview/Introduction

On October 22, 2026, Arista Networks issued an emergency advisory warning customers that a critical SQL injection zero-day (CVE-2026-114625) is being actively exploited against its VeloCloud Orchestrator (VCO). VCO is the central management plane for Arista’s SD-WAN solution, formerly VMware SD-WAN by VeloCloud. The vulnerability allows an adversary who can log in with the lowest-privilege, read-only role to obtain full operator rights, effectively granting unrestricted control over the orchestrator and the data it manages.

Technical Details

The vulnerability resides in the web-based management interface of VCO. An attacker who can reach the VCO portal and authenticate with any valid account- even a Enterprise Read-Only user- can inject crafted SQL payloads into a vulnerable API endpoint that fails to properly sanitize input. The malformed query bypasses the role-based access control (RBAC) checks and returns a privileged session token that the orchestrator treats as an Operator (the highest level of privilege).

Key technical attributes:

• CVE-2026-114625 - Critical SQL injection (CVSS 9.9).
• Attack vector: Network-accessible web UI; requires a valid login (authenticated).
• Exploitation method: Classic UNION-based injection that appends a SELECT … FROM users WHERE role='operator' clause, then leverages a second-stage request to swap the session cookie.
• Prerequisite: Any account with the built-in Enterprise Read Only role; no additional privileges needed.
• Impact: Full operator control, ability to create/modify/delete customers, partners, and network policies; potential to execute commands on the underlying host via stored procedures.

Impact Analysis

The flaw affects all VCO deployment models:

• On-premises installations - vulnerable in releases prior to VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12.
• Hosted (Arista-managed SaaS) - already patched, but legacy customers may still be on vulnerable releases.
• Dedicated (single-tenant cloud) - likewise patched, yet older images can be left behind.

Because VCO is the single point of control for the entire SD-WAN fabric, a compromised orchestrator can be used to:

• Harvest configuration files, topology maps, and credential stores.
• Inject malicious routing policies, effectively hijacking traffic across the corporate WAN.
• Deploy malicious firmware updates to edge devices (VeloCloud Edge and Gateway are not directly vulnerable, but can be compromised via orchestrator-driven pushes).
• Exfiltrate or encrypt data, paving the way for ransomware or data-theft campaigns.

Given the prevalence of Arista’s SD-WAN solutions in Fortune 500 enterprises, the potential attack surface spans multiple verticals- finance, healthcare, manufacturing, and critical infrastructure.

Timeline of Events

• July 2025 - Arista acquires VeloCloud from Broadcom, re-branding the SD-WAN portfolio.
• Late July 2026 - First VCO zero-day (CVE-2026-16812) reported, but it did not require authentication.
• September 2026 - Second zero-day (CVE-2026-93952) disclosed, also unauthenticated.
• October 22 2026 - Arista publishes advisory for CVE-2026-114625, confirming active exploitation.
• October 24 2026 - Fixed releases made available: VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12.
• October 28 2026 - This blog post is published to raise awareness and guide remediation.

Mitigation/Recommendations

Organizations should take the following immediate steps:

1. Patch now. Upgrade to the fixed VCO releases listed above. For hosted/dedicated services, verify with Arista that the underlying instance runs a patched image.
2. Restrict network exposure. VCO should never be reachable from the public internet. Deploy firewall rules or VPN-only access to the web UI.
3. Enforce MFA. Even read-only accounts must be protected with multi-factor authentication to reduce credential-theft risk.
4. Audit RBAC. Review all user accounts; remove unnecessary read-only accounts or replace them with custom roles that lack UI access.
5. Monitor logs. Look for anomalous session token swaps, repeated failed SQL queries, or unexpected operator-level actions from low-privilege accounts.
6. Conduct a forensic sweep. After patching, assume compromise and verify integrity of configuration backups, edge-device firmware versions, and any scripts pushed from the orchestrator.

For organizations still on end-of-support release trains, contact Arista Technical Assistance for a migration path or emergency patch.

Real-World Impact

Because the attack chain starts with a legitimate login, traditional intrusion-detection systems that focus on exploit code or network scans may miss the activity. An adversary can silently pivot from a low-privilege service account-perhaps compromised via phishing or credential stuffing-to full control of the WAN fabric. The downstream effects include:

• Potential data exfiltration from branch offices that route traffic through the SD-WAN.
• Manipulation of QoS policies to degrade or intercept critical business applications.
• Insertion of back-doors into edge devices, extending the attacker’s foothold beyond the orchestrator.
• Regulatory fallout for industries that must protect patient, financial, or industrial control data.

Early reports from unnamed victims suggest attackers used the operator role to create new admin accounts, export configuration bundles, and in at least one case, launch a ransomware payload against the corporate network after establishing persistence via the SD-WAN tunnel.

Expert Opinion

From a broader security perspective, CVE-2026-114625 underscores a dangerous shift in the threat landscape: attackers are increasingly targeting management planes rather than the data plane. The fact that a read-only credential-normally considered “view-only”-can be leveraged to break the entire RBAC model indicates a systemic design flaw in how VCO validates session context. Vendors must adopt defense-in-depth principles, including:

• Zero-trust segmentation of management interfaces.
• Rigorous input validation at every API boundary, not just the “admin” endpoints.
• Continuous security testing (red-team, bug-bounty) that includes authenticated attack scenarios.

Enterprises should treat SD-WAN orchestrators as high-value assets-akin to core firewalls or identity providers-and apply the same hardening standards. The rapid succession of three zero-days within a few months suggests that the underlying codebase may have legacy components that were insufficiently audited during the Broadcom-to-Arista transition. A thorough code review and a shift toward a micro-service architecture with least-privilege inter-service communication could mitigate similar issues in future releases.

In short, the VeloCloud SQL injection is not just another CVE; it is a wake-up call that privileged-escalation pathways in network-management software can be weaponized at scale. Organizations that delay patching or ignore the need for strict access controls risk losing control of the very network they rely on for business continuity.