A severe security vulnerability has been identified in Arista's VeloCloud Orchestrator, the core management system for VeloCloud SD-WAN networks. This zero-day SQL injection flaw allows attackers to gain operator-level privileges even with a read-only customer account, providing them with comprehensive control over the orchestrator. Arista has acknowledged the issue, which is tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale, highlighting its critical nature.
The vulnerability affects both on-premises and hosted orchestrators. For on-premises systems, fixes are available in VCO versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. Hosted and Dedicated orchestrators have already been patched. However, orchestrators running updates from July and September remain vulnerable, as these patches are older than the newly released fixes.
Arista acquired the VeloCloud SD-WAN product line from Broadcom in July 2025. Previously known as VMware SD-WAN by VeloCloud, these products are now under scrutiny due to this significant security flaw. The flaw requires network access to the orchestrator's web interface, with at least an Enterprise Read Only user role to exploit it. This vulnerability allows attackers to potentially act as local superusers, granting them full access to the orchestrator and potentially compromising the VCO host.
While Arista's advisory does not specify the onset of these attacks or the exact orchestrators affected, it notes that this is the third VCO vulnerability reported since July. Unlike the previous flaws, this one necessitates a valid login. The July and September vulnerabilities did not require authentication. VeloCloud Gateway and VeloCloud Edge remain unaffected by this flaw.
To mitigate risks, Arista advises customers to block specific IP addresses involved in the attacks and review web access logs for suspicious activities. Customers using unsupported release trains are encouraged to contact Arista's Technical Assistance Center for upgrade options. Until updates are applied, it is crucial to preserve evidence of any compromise to aid in forensic investigations.
