Threat Intelligence

Arista VeloCloud Orchestrator Flaw Exploited in Attacks: Even Read-Only Logins Can Lead to Full Control

The Hacker News · 23 Oct 2026

Key Takeaway If you run an on-premises VeloCloud Orchestrator, upgrade to a fixed release now, even if you already applied earlier patches, and review who has accounts and network access to it.

Arista said in an advisory on October 22 that attackers are exploiting a zero-day SQL injection flaw in VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks. The flaw is tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale. Anyone who can log in, even with a read-only customer account, can gain operator privileges, the highest level of control. It may also let an attacker affect the VCO host itself and expose, modify or disrupt the orchestrator and the data it manages.

An attacker needs network access to the orchestrator's web interface and a valid login. VCO is exposed by default, and no setting prevents this. Fixes for on-premises orchestrators are in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted and Dedicated orchestrators have already been patched. Systems running the releases that fixed the July and September flaws are still affected, because those releases are older than the new fixes. VeloCloud Gateway and Edge are not affected, and Arista says any release not on its list is not vulnerable.

This is the third VCO flaw reported as exploited since late July, and the first to require a login. The advisory does not say when the attacks began, which orchestrators were hit, or what attackers did afterwards. Arista has not checked releases that have reached end of support, so those customers should contact Arista's Technical Assistance Center about upgrade options.

Arista VeloCloud SD-WAN Zero-Day SQL Injection

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.