If you run VeloCloud SD-WAN with an on-prem Orchestrator, put this at the top of your list. Arista released fixes for CVE-2026-114625, a critical, actively exploited flaw in VeloCloud Orchestrator (VCO) on-prem, BleepingComputer reported today.
What’s going on
- It’s a low-complexity SQL injection. An attacker with basic privileges and a valid session on the VCO web interface can escalate to operator and masquerade as the local “superuser operator.”
- That opens functionality meant for internal use only, and can compromise the orchestrator and the data it manages. That’s your whole SD-WAN control plane.
- Hosted VCO is already patched on 5.2.3.18+, 6.1.3.10+ and 6.4.2.12+. On-prem customers need to update.
- Until you can patch: restrict the VCO web UI to admin networks, review recent admin activity, and watch the web access logs for odd paths, encoded characters, references to internal services and high request rates. Arista also published attacker IPs to block.
- If you suspect compromise, preserve web, application, system and database logs and file timestamps before you remediate, then call Arista TAC.
My take
I’ve been doing networking a long time, and the lesson keeps repeating: management planes don’t belong on the open internet, and “authenticated only” is not a security boundary when any low-level account can become superuser. Patch it, then make sure that UI is only reachable from your admin network or VPN. Same rule I use on my own gear and my own WordPress admin.
Have a blessed day! And Happy Hacking!
