CISA added CVE-2026-114625, an SQL injection vulnerability in on-premises Arista VeloCloud Orchestrator (VCO), to its Known Exploited Vulnerabilities catalog after Arista confirmed attackers are using it in the wild. Most trackers score it CVSS 9.9 (one lists 9.4). It is the third VCO flaw exploited as a zero-day in roughly four months.

What happened

Arista’s advisory (SA 0199) describes an SQL injection in the Orchestrator that lets any authenticated user gain operator privileges and act as a local “superuser operator”, including reaching functions intended for internal use only. Because the Orchestrator is the SD-WAN control plane, that privilege level governs edge configuration, tenant data and device management for every site it manages.

Hosted and dedicated Orchestrator instances managed by Arista have already been patched. Customer-run on-prem deployments are the exposed population.

Technical details

  • Bug class: SQL injection in a backend query path reachable by a low-privileged authenticated account, resulting in privilege escalation to operator/superuser rather than simple data disclosure.
  • Prerequisite: valid credentials of any role. That is a modest bar given how many MSP and multi-tenant VCO deployments hand out tenant-level accounts, and given the earlier VCO authentication flaws that attackers have already used to obtain access.
  • Affected builds: on-prem Orchestrators below the fixed releases. Arista notes that releases which fixed the July and September VCO issues are still vulnerable here, so being current as of last quarter is not enough.
  • Observed attacker infrastructure: Arista lists two source addresses seen in exploitation: 74.82.197.86 and 38.54.50.151.

Fixed versions

Upgrade on-prem Orchestrators to 5.2.3.18, 6.1.3.10 or 6.4.2.12, or later in the respective train.

Impact

Compromise of the Orchestrator is effectively compromise of the SD-WAN fabric: attackers with operator rights can read tenant and customer configuration, modify edge policy and routing, and use the management channel as a pivot toward branch networks. This follows CVE-2026-93952 and CVE-2026-16812, both also exploited, which suggests sustained attacker interest in this product line. Organisations that were breached through the earlier flaws and only patched should treat the Orchestrator as potentially already compromised.

What to do now

  1. Upgrade to the fixed releases above. Federal agencies must remediate on the KEV deadline.
  2. Until patched, restrict the Orchestrator web UI and API to trusted administrative networks; do not expose it to the internet.
  3. Hunt for the two IPs above in reverse-proxy, application and database logs, and look for unexpected successful logins followed by privilege changes.
  4. Audit operator and superuser accounts, API tokens and edge policy changes for modifications you cannot attribute to a change ticket.
  5. Rotate Orchestrator-held secrets (API tokens, service credentials, certificates) if any indicator matches.
  6. Monitor for unexpected outbound connections from the Orchestrator host.

References