Arista VeloCloud Orchestrator: exploited SQL injection (CISA KEV)

On 23 October 2026 CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities (KEV) catalog: the vulnerability in Arista VeloCloud Orchestrator (VCO) is therefore already exploited in real attacks. The catalog calls it “Arista VeloCloud Orchestrator SQL Injection Vulnerability”.

For US federal agencies the deadline to act is 26 October 2026, just three days after the listing. The CVE record in the NVD database was published on 22 October.

This article is based on a single source, the KEV catalog entry with the description published in the NVD database: the information that follows is what is reported there.

What happened

VeloCloud Orchestrator is the centralised management console of the VeloCloud SD-WAN solution. According to the description published in the NVD database, the vulnerability affects on-prem installations of the orchestrator and may allow a remote attacker to access privileged internal functionality and to impact the host running VCO.

In practice, on an affected system any authenticated user can gain operator privileges and masquerade as the local “superuser operator” user. This also gives access to functionality intended for internal use only, which is not meant to be remotely accessible.

According to the same description, successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and of the data it manages.

Hosted versions, including Dedicated ones, were also affected and have already been patched.

Technical details

• CVE: CVE-2026-114625.
• Product: Arista VeloCloud Orchestrator (VCO), on-prem installations.
• Weakness: CWE-89 (SQL injection), as the KEV catalog title also states. The NVD description does not explain which function contains the flaw.
• Impact: privilege escalation from authenticated user to “superuser operator”, access to internal functionality not meant for remote use, impact on the VCO host.
• CVSS scores, both assigned by the Arista PSIRT:
  • 9.9 (critical) in CVSS 3.1: network attack, low complexity, low privileges (any account), no user interaction, scope changed, high impact on confidentiality, integrity and availability;
  • 9.4 (critical) in CVSS 4.0: same preconditions, with high impact both on the vulnerable system and on subsequent systems (SC, SI and SA high).
• Affected and fixed versions: the source does not list them; they are in Arista security advisory 0199.
• Exploitation: confirmed by CISA through the KEV listing. Use in ransomware campaigns is, according to CISA, currently unknown.
• MITRE ATT&CK: exploiting an application reachable over the network maps to T1190 (Exploit Public-Facing Application), and using an existing account as the starting point to T1078 (Valid Accounts). The source describes neither the attack chain nor indicators of compromise.

The scope changed in CVSS 3.1 and the high subsequent-system values in CVSS 4.0 indicate that, in Arista’s assessment, the consequences do not stay confined to the orchestrator.

Impact for European and Italian companies

The orchestrator is the point from which the SD-WAN network is governed: whoever controls it with operator privileges acts on the component that manages the network and on the data it holds. The need for an authenticated user is not much of a barrier: according to the description, any account will do, even one with minimal privileges.

For entities within the scope of NIS2, timely vulnerability management is one of the required measures, and a compromise must be assessed for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN. The same applies to healthcare organisations that connect several sites through an SD-WAN network managed by an on-prem orchestrator.

What to do now

1. Inventory: check whether your company, or the provider that manages your network, runs an on-prem VeloCloud Orchestrator. Hosted instances, including Dedicated ones, have already been patched by Arista.
2. Update: apply the fixes or mitigations listed in Arista advisory 0199. CISA asks to apply the vendor’s mitigations or, if none are available, to stop using the product.
3. Reduce exposure: CISA asks to assess how exposed each instance is to the internet. Until the update is applied, consider making the orchestrator interface reachable only from the management network or through a VPN.
4. Review accounts: according to the description, any authenticated user is enough. Remove accounts no longer in use and check who has access to the orchestrator.
5. Look for signs of compromise: for federal agencies, CISA refers to its forensic triage requirements. On vulnerable instances, review the orchestrator and host logs, activity performed with operator privileges and configuration changes.
6. Credentials: if you find signs of compromise, replace the credentials of the orchestrator accounts and those used by its integrations.

How ARXDOME helps

ARX Expose shows which services your company exposes on the internet, which products are recognised on them and which have known vulnerabilities: it helps you find out whether a management interface is reachable from outside. ARX Shield lists the open vulnerabilities on monitored machines and highlights those already exploited by attackers. ARX Sentry collects logs and events from the servers where the agent is installed, including privileged logons and account changes. With ARX Horizon you can look up vulnerability details and search for indicators of compromise from the portal.

Last updated: 23 October 2026