Actively exploited VeloCloud Orchestrator SQL injection turns read-only users into operators

Arista has shipped patches for a critical SQL injection in VeloCloud Orchestrator (VCO), the platform used to configure and monitor VeloCloud SD-WAN networks. According to a write-up by Netics on dev.to, the flaw, tracked as CVE-2026-114625, lets any holder of the lowest tenant login escalate to operator-level control of the orchestrator, and Arista's advisory states the issue is already being exploited in the wild.

What the advisory says

Arista Security Advisory 0199, published on 22 October 2026, rates the vulnerability 9.9 under CVSS 3.1 and 9.4 under CVSS 4.0, classifies it as CWE-89 (SQL injection) and records the internal bug identifier BUG2043622. Exploitation needs two things: network access to the VCO web interface and a valid authenticated session on the portal. The minimum role required is Enterprise Read Only, the lowest built-in tenant role.

The exposure picture is unusually blunt. Arista's advisory says the web interface ships exposed by default and that no configuration setting eliminates the exposure, which removes the usual comfort answer from an audit checklist. Hosted and dedicated orchestrator deployments were affected but have already been patched by Arista; customers who run the appliance on their own hypervisors are the ones left with upgrade work in their own change process.

From read-only tenant to orchestrator superuser

On an affected system, any authenticated user can gain operator privileges and masquerade as a local superuser operator, reaching functionality intended for internal use only and never meant to be reachable remotely. In practice, as Netics points out, that means a customer account granted a read-only view — the role designed to let tenants check circuit status and inventory without touching policy — becomes a full control point for the platform.

The orchestrator is a concentration point by design: it holds the configuration for every site in the network, the tunnels between them and the accounts of the partners who resell or manage those sites. When the lowest tenant role is enough to become a superuser, the account inventory of the orchestrator becomes the real perimeter, and every tenant login a partner or integrator kept after a project ended sits inside it.

Second critical flaw in a month

This is the second critical advisory for the same product in about a month. Security Advisory 0183, published on 22 September 2026, covers CVE-2026-93952, scored 10.0 under CVSS 3.1 and 9.5 under CVSS 4.0 (CWE-20), with an attack vector that required no privileges at all. The October flaw needs a valid session but reaches operator rights from a tenant login. Netics also flags a planning gap: the October advisory does not say whether the fixed 6.1 release also carries the September fix, so operators on that train should confirm coverage with Arista before treating the upgrade as complete.

Fixes and interim measures

Patches ship per release train: VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12, with later releases included. End-of-support versions have not been assessed, and Arista directs operators on unsupported trains to its Technical Assistance Center for upgrade options.

While the upgrade window is being booked, Netics suggests two compensating moves: shorten the network path to the web interface so it is reachable only from management networks or over a VPN, and close tenant accounts that no longer belong to an active working relationship.

Indicators and log review

Arista lists two source addresses observed in the attacks, 74.82.197.86 and 38.54.50.151, and asks operators to block them and search logs for their presence. Patterns worth reading in VCO web access logs include unusual URL-like path components, encoded characters, references to local or internal services, and high request rates — the fingerprints of an injection being probed. Where compromise is suspected, the advisory asks operators to preserve web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediating, since patching over the only evidence leaves the question of what happened unanswered.

The Hacker News reports that the advisory does not say when the campaign began, which orchestrators were hit, or what the attackers did after exploiting the flaw, nor whether an upgrade removes access already obtained. The fix should be treated as closing the entry path, not the aftermath.

Why it matters

An SD-WAN orchestrator holds the routing policy for an entire estate, so a flaw that converts the lowest tenant login into superuser control is a whole-network event, not a single-system one. With active exploitation confirmed, no configuration-based mitigation available and two critical advisories in the same product inside a month, the practical response for self-hosting operators is short but urgent: inventory every orchestrator, match each build against the fixed trains, close stale tenant accounts and book the upgrade window now — then review logs as if the entry path had already been used.