Executive Summary
Arista Networks has disclosed active exploitation of a critical SQL injection vulnerability, tracked as CVE-2026-114625, affecting VeloCloud Orchestrator (VCO). While the attack requires an authenticated session, attackers only need the lowest built-in tenant role (Enterprise Read Only) to execute the exploit. Successful exploitation allows an attacker to impersonate a local "superuser operator" account, gaining unauthorized access to internal functions and sensitive managed data.
Technically, the vulnerability is classified as CWE-89 and resides in the VCO web interface. Arista has confirmed that default configurations leave the orchestrator exposed, and while hosted deployments have been patched, on-premises installations remain at significant risk unless updated. The attack complexity is low and requires no user interaction, making it a high-priority target for adversaries seeking to compromise SD-WAN infrastructure.
The business impact is severe, as VeloCloud Orchestrator manages critical network configurations and traffic. Compromise could lead to full loss of confidentiality, integrity, and availability across the orchestrator and its managed edge devices. Organizations using affected on-premises versions (5.2.x, 6.1.x, and 6.4.x release trains) must prioritize patching and perform forensic reviews of their environments.
Key Details
Threat Name
CVE-2026-114625
Affects
VCO 5.2.x (before 5.2.3.18), VCO 6.1.x (before 6.1.3.10), VCO 6.4.x (before 6.4.2.12)
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified