VeloCloud SQL injection enables full operator access
VeloCloud SQL injection attacks are exploiting a critical flaw that can turn the lowest customer login into the highest level of control over VeloCloud Orchestrator. Arista said in an October 22 advisory that the vulnerability affects VeloCloud Orchestrator (VCO), the central management system for VeloCloud software-defined wide area networks (SD-WAN), which connect and centrally manage networks across multiple locations. The flaw is a zero-day, meaning attackers exploited it before affected organisations had an available fix.
The vulnerability, tracked as CVE-2026-114625, has a Common Vulnerability Scoring System (CVSS) rating of 9.9 out of 10. SQL injection is a weakness that allows specially constructed input to interfere with an application's database requests. Exploitation requires network access to the VCO web interface, which is the browser-based management console, as well as a valid account. However, the attacker only needs the Enterprise Read Only role, the least privileged built-in role available to customer users. Arista says VCO exposes the interface by default and does not provide a VCO setting that prevents that exposure.
A successful attacker can obtain operator privileges, the top level of control in the orchestrator. Operators can create customer and partner accounts, while partners can administer groups of customers. Arista says exploitation permits an attacker to act as a local superuser with unrestricted access. The vulnerability may also allow interference with the underlying VCO host, potentially exposing, changing or disrupting the orchestrator and the information under its management. The advisory does not identify the affected organisations, describe what attackers did after gaining access or state when exploitation started.
On-premises deployments, meaning VCO systems run within a customer's own environment, must be upgraded to the appropriate fixed release. The patches are VCO 5.2.3.18 or later for the 5.2 release train, VCO 6.1.3.10 or later for 6.1, and VCO 6.4.2.12 or later for 6.4. A release train is a maintained sequence of related software versions. Hosted and Dedicated orchestrators have already been patched. VeloCloud Gateway and VeloCloud Edge are not vulnerable, and the 7.0 train is absent from the affected list. Arista says releases not listed in the advisory are unaffected.
Arista has not assessed VCO versions that are no longer supported. Customers still using an unsupported release train can contact Arista's Technical Assistance Center about available upgrade paths. The product line became part of Arista after its purchase from Broadcom was announced in July 2025. It was previously known as VMware SD-WAN by VeloCloud.
CVE-2026-114625 is the third VCO vulnerability since late July that Arista has reported as exploited. Unlike the new flaw, the July vulnerability, CVE-2026-16812, and the September vulnerability, CVE-2026-93952, did not require attackers to authenticate. Installing releases that addressed those earlier problems is not sufficient because those versions predate the latest fixes. In the 5.2 train, September's flaw was addressed in 5.2.3.16, while the new vulnerability requires 5.2.3.18. In 6.4, the earlier fix was 6.4.2.8, compared with 6.4.2.12 for the latest issue.
The September patch situation remains less clear for the 6.1 train. As of October 22, CVE-2026-93952 affected versions through 6.1.3.7, but no corrected 6.1 release was listed for that vulnerability. Neither advisory states whether 6.1.3.10, which fixes CVE-2026-114625, also addresses the September flaw. Administrators therefore should not assume that installing the new 6.1 build resolves both vulnerabilities without confirmation.
Where an immediate upgrade is not possible, Arista recommends allowing access to the VCO web interface only from trusted administrative networks. Organisations should monitor for connections involving known malicious Internet Protocol (IP) addresses, examine unexpected traffic leaving the VCO host and consider blocking outbound ports that normal operations do not require. They should also look for webshells, which are malicious remote-control programs placed on a web system, and backdoor daemons, which are hidden background services that provide continued access. Recent administrator activity should be checked for unexplained changes.
Arista identified 74.82.197[.]86 and 38.54.50[.]151 as IP addresses used in the attacks. Defenders should block them and search existing records for connections involving either address. VCO web access logs should also be reviewed for unusual path components, encoded characters, attempts to refer to local or internal services, and abnormally high request volumes. If compromise is suspected, evidence should be preserved before changes are made where possible. Relevant material includes web access, backend application, operating system and database logs, together with file-system timestamps.
Earlier advisories warned that compromise through the July and September flaws could also provide access to VeloCloud Edge devices. The latest advisory does not say whether that risk also applies to CVE-2026-114625, or whether installing the update removes access that an attacker may already have established. For organisations that need outside support with broader infrastructure security planning, AEU-I offers security-first IT, infrastructure and consulting. The immediate priorities for VCO operators are to install the correct release, restrict access to the management interface and investigate the indicators described by Arista.