Arista VeloCloud Orchestrator CVE-2026-114625: a SQL injection that crosses the privilege boundary
Arista published advisory SA-0199 on 22 October and confirmed that attackers are already using the flaw tracked as CVE-2026-114625. The vulnerability sits in the VeloCloud Orchestrator, the management plane that provisions and monitors VeloCloud SD-WAN edges. Its CVSS score is 9.9.
The impact comes from where the injection lands: in the orchestration layer that decides who may configure which customer network.
How the flaw works
VeloCloud Orchestrator (VCO) is a multi-tenant management system. Operators and partners create customer accounts, and each partner can manage a group of customers. Access is role based, and the lowest built-in role for customer users is Enterprise Read Only.
The injected input reaches a SQL query in the orchestrator's backend. Because the query is built from request data, a crafted request can alter the statement that the application executes rather than only supplying a value to it. Arista describes the outcome as execution in the context of a local superuser, which is the operator role with full access.
That detail explains the score. A read-only customer account is designed to look at inventory, topology and reports. The flaw lets the same account perform actions reserved for the operator tier.
Exploitation conditions
Two things are needed, and both are ordinary in enterprise deployments:
- Network access to the VCO web interface, which Arista states is exposed by default and cannot be disabled through a VCO setting.
- A valid login, at Enterprise Read Only or higher.
This is the first of three VCO flaws Arista has reported as exploited since late July that requires authentication. The July issue, CVE-2026-16812, and the September issue, CVE-2026-93952, did not. Those two set a different baseline: an unauthenticated attacker. CVE-2026-114625 raises the bar slightly and still leaves the orchestrator reachable by anyone holding a legitimate but low-privilege account, including partner-held accounts that manage several customers.
Impact
An operator-level session on VCO controls the SD-WAN fabric for every customer the tenant owns. Arista says the flaw may also let an attacker affect the VCO host itself, exposing, modifying or disrupting the orchestrator and the data it manages.
The advisory does not state when exploitation began, which orchestrators were hit, or what attackers did afterwards. It does list two source addresses observed carrying out the attacks.
A compromised orchestration layer is a different problem from a compromised edge device. Edge and Gateway hardware do not carry the CVE, yet the orchestrator is where the configuration for those devices is written.
Affected and fixed releases
Fix versions differ per release train:
| Release train | Affected | Fixed in |
|---|---|---|
| 5.2 | before 5.2.3.18 | 5.2.3.18 and later |
| 6.1 | before 6.1.3.10 | 6.1.3.10 and later |
| 6.4 | before 6.4.2.12 | 6.4.2.12 and later |
Hosted and Dedicated orchestrators have already been patched by Arista. VeloCloud Gateway and VeloCloud Edge are not affected. The 7.0 train is not listed, and Arista says a release that is not on the list is not vulnerable. Releases past end of support were not checked. Customers on an unsupported train can contact Arista's Technical Assistance Center about upgrade options.
Orchestrators running the builds that fixed the July and September flaws are still affected, because those builds are older than the fixes shipped now. Patching once in the summer does not cover this.
Remediation and interim controls
Install the fixed release for the train in use. Until that happens, Arista recommends:
- Restrict access to the VCO web interface to trusted administrative networks.
- Monitor the orchestrator for connections from known malicious addresses.
- Watch for unexpected outbound network traffic from the VCO host.
- Block outbound ports that normal operation does not need.
- Look for backdoor daemons and webshells.
- Review recent administrator activity for changes nobody made deliberately.
Checking for compromise
Arista names two addresses seen in the attacks: 74.82.197[.]86 and 38.54.50[.]151. Block them and search logs for both.
Then read the VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, or abnormal request rates. If a compromise is suspected, preserve the web access, backend application, system and database logs and the relevant file-system timestamps before repairing anything.
The July and September advisories warned that a compromised orchestrator could also open a path to VeloCloud Edge devices. For CVE-2026-114625 the advisory does not say whether that still applies, or whether upgrading removes access an attacker already obtained. Treat an upgraded but previously reachable orchestrator as a system whose operator tier needs verification.
Exposure
A ZoomEye query for title="VeloCloud" matches 529 assets. That number describes product exposure, not a count of confirmed vulnerable orchestrators, and a match does not prove an installation is unpatched.
Sources
- Arista Security Advisory 0199: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
- Arista Security Advisory 0183 (September flaw): https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
- The Hacker News report: https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html
Top comments (0)