CVE-2026-114625 is an actively exploited SQL-injection flaw in the on-premises edition of Arista VeloCloud Orchestrator (VCO), the web-based control plane for VeloCloud SD-WAN. VCO centralizes installation, policy, configuration and real-time monitoring for networks spanning branches, data centres and cloud environments; enterprises run it directly, while service providers and managed providers use it to administer customer and partner networks.
The affected component is not an edge appliance. VCO manages operator users, gateways, gateway pools and authentication settings, making compromise of the orchestrator materially different from compromising one branch device: it puts the management system and the data it holds in scope. Arista says VeloCloud Edge and VeloCloud Gateway are not affected.
A read-only portal account can become an operator
SQL injection means attacker-controlled input is interpreted as part of a database query rather than solely as data. Here, the attacker first needs network access to the VCO web interface and a valid portal session. The lowest sufficient role is Enterprise Read Only, but Arista says exploitation can elevate that user to operator privileges and let them masquerade as a local “superuser operator”.
That identity can reach internal functions that were not meant to be remotely available, and the resulting impact can extend to the confidentiality, integrity and availability of both the orchestrator host and the network-management data it controls. The advisory does not disclose the vulnerable endpoint, parameter, SQL statement or request sequence, so teams should not assume that restricting a single URL addresses the problem. VCO’s interface is exposed by default, and Arista says no configuration removes the underlying exposure.
Exploitation is confirmed; public exploit details are not
Arista detected attacks and says the flaw is known to be actively exploited, although it has not said when exploitation began, how attackers obtained authenticated sessions, or what they did after elevation. It published two observed source IP addresses, but no victim, threat actor, malware family or campaign has been identified. Defensive advice to look for webshells and backdoor daemons is not confirmation that either appeared in these incidents.
The issue entered CISA’s Known Exploited Vulnerabilities catalogue on October 23, 2026, with a federal remediation due date of October 26; ransomware-campaign use is recorded as unknown. No public proof of concept or exploit code had surfaced in reviewed sources as of October 24, and the public advisory record reports no known source code. That does not rule out private tooling.
Upgrade the control plane, then investigate it
On-premises deployments need to move to the fixed release in their supported train:
5.2.x: 5.2.3.18 or later
6.1.x: 6.1.3.10 or later
6.4.x: 6.4.2.12 or later
Hosted and Dedicated VCO were affected but already patched. Unsupported releases have not been assessed; contact Arista TAC rather than assuming an old build is safe. Teams should also review portal accounts and sessions, limit web-interface reachability where operationally possible, inspect VCO and host logs for unusual URL-like paths, encoded characters, internal-service references and high request rates, and hunt for unexpected accounts, processes or persistence.
There is one documentation wrinkle worth tracking: Arista’s machine-readable CSAF file calls it remote code execution and presents incomplete-looking remediation data, while the canonical advisory describes SQL injection and lists the fixed trains above. Use the canonical advisory for patch decisions. For organisations whose SD-WAN control plane is easy to overlook, SecAlerts monitors the software stack they actually run and alerts on new vulnerabilities affecting those products.
