Arista Warns of Critical VeloCloud SQL Injection Zero

Arista Networks disclosed a critical SQL injection vulnerability in VeloCloud Orchestrator that attackers are actively exploiting to escalate privileges from read-only accounts to full operator control. The flaw, tracked as CVE-2026-114625, carries a CVSS score of 9.9 and affects on-premises orchestrators running versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12.

Arista Networks warned Tuesday that attackers are exploiting a zero-day SQL injection flaw in VeloCloud Orchestrator (VCO), the central management platform for VeloCloud SD-WAN networks. The vulnerability, tracked as CVE-2026-114625, carries a CVSS rating of 9.9 and allows any authenticated user — even those with the lowest built-in role, Enterprise Read Only — to escalate privileges to operator level, the highest tier of control over the orchestrator.

The flaw requires network access to the VCO web interface and a valid login. VCO exposes its web interface by default, and no configuration setting prevents this exposure. Once exploited, an attacker can act as a local superuser with full access to the orchestrator and potentially affect the underlying host system, exposing, modifying, or disrupting managed data.

Arista has released fixes for three on-premises release trains:

Hosted and Dedicated orchestrators have already been patched. The 7.0 release train is not affected. VeloCloud Gateway and VeloCloud Edge devices are not vulnerable.

This marks the third exploited vulnerability in VCO since late July. The two — CVE-2026-16812 (July) and CVE-2026-93952 (September) — required no authentication. This is the first that demands a valid login. Arista noted that orchestrators patched for the July and September flaws remain vulnerable to this new issue because those releases predate the current fixes.

The advisory does not disclose when attacks began, which orchestrators were compromised, or what actions attackers took post-exploitation. Arista identified two IP addresses observed carrying out attacks:

Organizations should block these addresses and scan logs for connections from them. Additional indicators of compromise include web access logs showing unusual URL-like path components, encoded characters, references to local or internal services, or abnormally high request rates.

For organizations unable to upgrade immediately, Arista recommends:

Restricting VCO web interface access to trusted administrative networks

Monitoring for connections from known malicious IPs

Watching for unexpected outbound network activity from the VCO host

Blocking unnecessary outbound ports

Scanning for backdoor daemons and webshells

Reviewing recent administrator activity for unauthorized changes

If compromise is suspected, Arista advises preserving evidence — including web access logs, backend application logs, system and database logs, and relevant filesystem timestamps — before remediation.

Arista acquired the VeloCloud SD-WAN product line from Broadcom in July 2025. The products were previously known as VMware SD-WAN by VeloCloud. Customers on unsupported release trains should Arista's Technical Assistance Center for upgrade options.

As of October 22, the September vulnerability (CVE-2026-93952) remains unpatched in the 6.1 train beyond version 6.1.3.7. Arista has not confirmed whether the new 6.1.3.10 release also addresses that flaw.

Source : thehackernews.com