A read-only login is enough to take over Arista VeloCloud Orchestrator
A SQL injection lets any authenticated user, even one with read-only access, escalate to superuser on the SD-WAN management platform. CISA confirms it is already under attack.
Arista published Security Advisory 0199 on 22 October for CVE-2026-114625, a SQL injection in VeloCloud Orchestrator (VCO) On-Prem, the management platform for its VeloCloud SD-WAN. Any logged-in user, even one holding only the “Enterprise Read Only” role, can use it to gain operator privileges and masquerade as a local superuser, reaching internal functionality that is meant to stay out of reach entirely.
The bug scores 9.9 on CVSS v3.1. Arista says it found the issue itself and that it is already being actively exploited. Fixed versions are 5.2.3.18, 6.1.3.10 and 6.4.2.12; Arista’s own hosted and Dedicated instances have already been patched. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 23 October, with a due date of 26 October for federal agencies.
Why it matters: this isn’t a flaw that needs admin access to trigger. Anyone with the lowest read-only login on a VCO portal, including a contractor or auditor account, can turn it into full control of the orchestrator. If you run VeloCloud Orchestrator on-prem, patch now rather than waiting for the next maintenance window.
The caveat: exploitation needs network access to the VCO web interface plus a valid authenticated session, so an instance with no exposed portal and tight account hygiene is less exposed. Arista hasn’t attributed the activity to a specific actor.