Arista has issued a high-severity alert for a zero-day SQL injection vulnerability in its VeloCloud Orchestrator (VCO) that’s actively being used in attacks. This weakness, identified as CVE-2026-114625 and rated 9.9 on the CVSS scale, allows anyone with even a read-only customer account to escalate to operator privileges — a role with nearly unrestricted control over the orchestration environment. Users of on-premises VCO environments have new updates to deploy; cloud and hosted setups are reported fully patched.
Affected Systems & Patch Paths
The impacted product, VCO, is the management hub for VeloCloud SD-WAN — formerly VMware SD-WAN — acquired by Arista in mid-2025. The vulnerability exists in three release trains: 5.2, 6.1, and 6.4. Systems running versions prior to 5.2.3.18, 6.1.3.10, or 6.4.2.12 remain vulnerable; these patched versions correct the issue. Importantly, VeloCloud Gateway and Edge components are unaffected, as are any systems on newer trains or already upgraded.
Exploit Conditions & Mitigation Guidance
To exploit this zero-day, attackers need network access to the VCO web interface and valid credentials — even if those credentials are tied to the lowest privilege level, “Enterprise Read-Only.” VCO is exposed by default, and there is no built-in feature to disable that exposure. The flaw allows escalation to a local superuser role, potentially enabling control over the orchestrator and its database, plus disruption of the system.
Arista offers several countermeasures until patches can be applied: restrict access to trusted administrative networks; monitor for unusual connections or request patterns; block unnecessary outbound ports; search for webshells or unusual daemons; review administrative logs for unexpected activity. Two IPs tied to known attacks — 74.82.197.86 and 38.54.50.151 — should be blocked, and relevant logs examined.
This is the third critical vulnerability in VCO disclosed since July 2026. Unlike prior zero-days, the current one requires credentialed access. Previous flaws (CVE-2026-16812 in July and CVE-2026-93952 in September) did not require a login, and the new fix does not guarantee revocation of access already gained by attackers.
For customers on unsupported VCO release trains, Arista is encouraging engagement with its Technical Assistance Center for guidance on upgrade paths and mitigation.
Why This Matters:When a defect allows privilege escalation from minimal access, the potential for broader compromise escalates sharply. As SD-WAN controllers are central to enterprise networks, such flaws can cascade into exposure of downstream devices and sensitive communications.
What to Watch:Verify whether your VCO instance has been updated to the patched versions; check whether you were operating on an older, vulnerable release. Monitor logs — especially for IP addresses tied to the exploit, odd requests at the web-interface level, or surges in admin activity. And for organizations on legacy versions, plan upgrades swiftly.
