Arista warns of exploited VeloCloud Orchestrator SQL flaw

Arista said on 22 October that attackers were exploiting a zero-day SQL injection flaw in VeloCloud Orchestrator, the control system for VeloCloud SD-WAN networks. It identified the issue as CVE-2026-114625.

The company said the weakness let a valid user reach operator-level access, including someone using the Enterprise Read Only role. It also said the orchestrator was exposed by default and that no setting blocked that exposure.

For on-premises systems, Arista listed fixes in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12. It said hosted and dedicated orchestrators had already been patched, and that VeloCloud Gateway and VeloCloud Edge were not affected.

Arista said the flaw could allow a local superuser level of access and might let an attacker affect the host and the data it handled. The advisory did not say when the activity started, which orchestrators were compromised, or what the attackers did after exploitation.

The company said two IP addresses had been seen in the attacks and recommended limiting web access, watching logs and preserving evidence if compromise was suspected. It also said the issue was the third exploited VCO flaw it had reported since late July, after earlier issues in July and September.