
Arista confirms attacks on critical VeloCloud Orchestrator flaw, its third this year
A read-only customer login is enough to take operator-level control of the SD-WAN management console
Arista Networks said on October 22 that attackers are exploiting CVE-2026-114625, a SQL injection flaw in the on-premises VeloCloud Orchestrator, the console that manages SD-WAN networks. The flaw is rated 9.9 on the CVSS scale. Any authenticated user, including one holding the lowest built-in customer role, can escalate to a local superuser operator. Arista says the orchestrator is exposed by default and no setting prevents it. Fixes are in releases 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted and dedicated instances are already patched. Arista published two attacker IP addresses and advised restricting web access to administrative networks. The advisory does not say when the attacks began or who was hit. It is the third VCO flaw Arista has reported as exploited since late July, and the first that requires a login.
Why it mattersA stolen low-privilege credential can now hand an intruder control of a system that governs traffic across an organization's branch sites.












