Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.

The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.

For on-premises orchestrators, the fix is in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, while Hosted and Dedicated orchestrators have already been patched.

The flaw is tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale. Orchestrators running the releases that fixed the VCO flaws exploited in July and September are still affected, because those releases are older than the new fixes.

Arista bought the VeloCloud SD-WAN product line from Broadcom, announcing the deal in July 2025. The products were earlier known as VMware SD-WAN by VeloCloud.

To exploit the flaw, an attacker needs network access to the orchestrator's web interface and a valid login. The minimum role is Enterprise Read Only, the lowest built-in role for customer users. VCO is exposed by default, and no VCO setting prevents the exposure.

In VCO, operators create the customer and partner accounts, and each partner can manage a group of customers. The flaw allows an attacker to act as a local superuser, a role with full access. It may also allow an attacker to affect the VCO host itself and expose, modify, or disrupt the orchestrator and the data it manages.

The advisory does not say when the attacks began, which orchestrators were hit, or what the attackers did after exploiting the flaw.

Source link