Arista VeloCloud Orchestrator SQL Injection Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.9Security Advisory

TL;DR 📌

  • Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
  • Highest CVSS: 9.9 (Critical).
  • Listed in CISA KEV (2026-10-23) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-114625.

What it is

This is a SQL injection vulnerability in Arista VeloCloud Orchestrator (VCO), specifically affecting on-prem deployments. The CVSS vector confirms a network-reachable flaw requiring low privileges (PR:L) and no user interaction, with a scope change — meaning the vulnerability lets an attacker affect resources beyond the component they initially authenticate to.

The mechanism: any authenticated user on an affected on-prem VCO instance can use SQL injection to escalate to operator privileges and masquerade as a local “superuser operator” account. This grants access to internal functionality that is not meant to be reachable remotely at all. In effect, a low-privileged authenticated user becomes a superuser, with the confidentiality, integrity, and availability of the orchestrator and the data it manages all at risk.

Arista’s hosted and dedicated VCO offerings were also affected by this issue but have already been patched by the vendor on those platforms. The exposure described here is specific to self-managed, on-premises VCO deployments.

The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-10-23, so it is known to be exploited.

What to do

  • Treat any on-prem VCO deployment as a priority — this is the deployment model left exposed, since hosted/dedicated instances are already patched by Arista.
  • Check Arista’s advisory for the fixed release for your on-prem VCO version; a specific fixed version was not available at time of writing, so confirm directly with Arista rather than assuming parity with the hosted patch.
  • Review VCO authentication and account access — any authenticated user, regardless of their intended privilege level, can exploit this, so audit who holds valid credentials on the orchestrator and tighten account provisioning in the meantime.
  • Because this is in CISA KEV, apply the fix on the timeline CISA directives require if you’re a US federal entity, and treat it as urgent regardless of sector.
  • Once patched, review VCO logs for signs of privilege escalation to the “superuser operator” role from accounts that shouldn’t hold it.

For leadership 🧭

Executive summary. A critical, actively exploited flaw in on-premises Arista VeloCloud Orchestrator lets any logged-in user escalate to superuser and take full control of the orchestrator and the data it manages. Arista’s hosted and dedicated VCO platforms are already patched, so the risk now sits entirely with self-managed on-prem deployments and needs urgent attention this week, not next change window.

Why it matters:

  • Privilege escalation requires only an existing low-privileged account on the orchestrator, not a separate exploit chain, so any valid credential becomes a path to superuser operator access.
  • The flaw reaches internal functionality that was never intended to be remotely accessible, meaning normal network segmentation around VCO’s public interface doesn’t contain it.
  • A compromised VCO host puts confidentiality, integrity and availability of the orchestrator at risk, along with all configuration and operational data it manages across the SD-WAN fleet it controls.
  • It is listed in CISA’s Known Exploited Vulnerabilities catalogue, so this is confirmed real-world exploitation rather than a theoretical weakness.

Now / Next / Later:

  • Now: Identify every on-prem VCO instance in your estate and confirm with Arista whether a fixed version is available for it, since none was published at time of writing.
  • Next: Apply Arista’s fix to all on-prem VCO instances as soon as it is released, and in the meantime audit and restrict which accounts hold valid VCO credentials, since any authenticated user can trigger the escalation.
  • Later: Build a standing review of VCO authentication logs and role assignments to catch unexpected elevation to the superuser operator role, and track on-prem VCO patch currency separately from the hosted/dedicated platforms.

Source