Organizations operating VeloCloud Orchestrator on premises face an urgent patch-and-investigate situation after Arista Networks confirmed active exploitation of a critical privilege-escalation vulnerability. The flaw allows a user with a valid but minimally privileged portal account to manipulate database queries and emerge with superuser operator access.

Tracked as CVE-2026-114625, the SQL injection vulnerability received a 9.9 rating under CVSS 3.1 and 9.4 under CVSS 4.0. Arista disclosed it on October 22 after identifying attacks in the wild. Hosted VeloCloud environments, including Dedicated instances, have already been updated by the vendor, but customers responsible for on-premises installations must take action themselves.

A low-privilege account becomes a powerful foothold

The vulnerability resides in the web interface of VeloCloud Orchestrator, also known as VCO. Exploitation requires network access to that interface and an authenticated portal session, so it is not a login-free compromise. That qualification offers little comfort, however: the lowest standard tenant role, Enterprise Read Only, is reportedly sufficient.

An attacker can submit crafted input that changes the intended database operation and impersonate a local superuser operator. This exposes internal functions that should never be available to an ordinary remote tenant. Because the orchestrator sits at the management center of an SD-WAN environment, losing control of it can threaten the confidentiality, integrity and availability of both the platform and the information it manages.

Arista says the issue is present in the default product exposure and cannot be eliminated through an alternative product configuration. Network restrictions can narrow the attack surface, but they do not remove the vulnerable code path.

Versions and fixes

The affected on-premises release trains and the first fixed versions are:

• VCO 5.2.x: upgrade to 5.2.3.18 or later.
• VCO 6.1.x: upgrade to 6.1.3.10 or later.
• VCO 6.4.x: upgrade to 6.4.2.12 or later.

VeloCloud Edge and VeloCloud Gateway are not affected, and the advisory also excludes Arista’s EOS-based products and several other named platforms. Administrators should inventory the management software rather than treating every VeloCloud appliance as vulnerable. Software outside its support lifecycle has not been assessed; organizations on those branches should contact Arista for a supported migration path.

Hunt before evidence disappears

Since exploitation has been confirmed, installing the update is only half the response. Arista associated attacks with source addresses 74.82.197.86 and 38.54.50.151. Blocking and searching for those addresses is a useful first step, but absence of a match should not be treated as proof that an environment is clean.

Defenders should review web, application, operating-system and database logs for unusual URL-like paths, encoded characters, references to internal services and bursts of requests. Changes to administrator accounts, unexpected outbound connections, unfamiliar services, webshells and altered file timestamps deserve particular attention. Relevant logs and timestamps should be preserved before remediation where possible so investigators retain evidence.

Immediate defensive priorities

• Apply the fixed release for the installed VCO branch without delay.
• Limit the web console to trusted administrative networks or a tightly controlled VPN.
• Review all tenant accounts, including read-only users, for theft or unexplained activity.
• Search for new privileged accounts, configuration changes and persistence mechanisms.
• Rotate sensitive credentials if investigation suggests the orchestrator was accessed.

The episode illustrates why “authenticated” should not be mistaken for low risk. Stolen credentials, compromised partner accounts or a malicious tenant can satisfy that condition, and this flaw then converts limited access into control of a central management system. With attacks already occurring, affected operators should handle CVE-2026-114625 as a potential incident, not merely another maintenance ticket.

Organizations should also coordinate patching with incident response so credential resets, evidence collection and containment occur in the correct sequence.