Arista Networks has patched a critical SQL injection vulnerability in VeloCloud Orchestrator after detecting active exploitation against affected systems.
Tracked as CVE-2026-114625, the vulnerability allows an attacker with even the platform’s lowest built-in tenant role to elevate privileges and impersonate a local superuser operator. Successful exploitation can compromise the confidentiality, integrity and availability of an organization’s SD-WAN orchestrator and its managed data.
Arista assigned the flaw a CVSS 3.1 severity score of 9.9 out of 10.
ATTACKERS NEED ONLY A LOW-PRIVILEGE ACCOUNT
The vulnerability affects on-premises VeloCloud Orchestrator, the centralized management platform used to administer VeloCloud SD-WAN environments.
Exploitation requires network access to the VCO web interface and a valid authenticated portal session. However, the minimum required role is Enterprise Read Only, the lowest built-in tenant role.
An attacker who compromises a low-privilege account can exploit the SQL injection flaw to access privileged internal functionality, become a superuser operator and potentially affect the VCO host itself.
The requirement for authentication limits exposure compared with an unauthenticated remote-code-execution flaw, but it does not substantially reduce the urgency. Credentials can be obtained through phishing, credential stuffing, infostealer malware or another compromised account.
AFFECTED AND PATCHED VELOCLOUD VERSIONS
The vulnerability affects these on-premises releases:
- VCO 5.2.x before 5.2.3.18
- VCO 6.1.x before 6.1.3.10
- VCO 6.4.x before 6.4.2.12
Administrators should upgrade to one of the following fixed versions or later:
- VCO 5.2.3.18
- VCO 6.1.3.10
- VCO 6.4.2.12
End-of-support versions have not been assessed. Organizations running an unsupported release should contact Arista’s Technical Assistance Center about available upgrade options.
Arista said hosted and dedicated VCO environments were also affected but have already been patched. Customers managing their own on-premises deployments must verify and update their installations.
VeloCloud Edge and VeloCloud Gateway products are not directly affected by this vulnerability.
ARISTA CONFIRMS ACTIVE EXPLOITATION
Arista discovered the vulnerability and confirmed that attackers are exploiting it in real-world incidents.
The company identified two source IP addresses associated with attacks:
- 74.82.197.86
- 38.54.50.151
Administrators should block these addresses where appropriate and search historical logs for connections from them. However, blocking two known addresses is not a complete defense because attackers can move to different infrastructure.
VCO web-access logs should also be examined for unusual URL-like path components, encoded characters, references to internal or local services and abnormally high request volumes.
PATCHING ALONE MAY NOT REMOVE AN ATTACKER
Installing the corrected release prevents continued exploitation of CVE-2026-114625, but it does not remove persistence established before the update.
Organizations that operated a vulnerable, reachable VCO system should determine whether exploitation occurred before treating the incident as resolved.
Arista recommends preserving VCO web-access logs, backend application logs, database logs, system logs and relevant file-system timestamps before remediation when operationally possible.
Defenders should investigate for:
- Unexpected administrator or operator activity
- Newly created or modified privileged accounts
- Unauthorized configuration changes
- Web shells or unfamiliar backdoor services
- Suspicious outbound network connections
- Unusual database activity
- Unexplained files or modified timestamps
- Access from unfamiliar locations or infrastructure
- High-volume or encoded web requests
A compromised orchestrator should be isolated and investigated using the organization’s incident-response procedures. Credentials and tokens accessible through the affected platform may also require revocation and rotation.