SQL injection lets any authenticated user become superuser operator on VeloCloud Orchestrator on-prem (CVE-2026-114625)
Arista's October 22 advisory confirms it detected this flaw, which is known to be actively exploited, and shipped fixes for all three supported lines, so an on-prem orchestrator left unpatched with any low-privilege account reachable is one login away from full compromise of the SD-WAN control plane.
A SQL injection (CWE-89) in VeloCloud Orchestrator (VCO) on-prem lets any authenticated user — including a basic read-only customer account — gain operator privileges and masquerade as the local "superuser operator", reaching internal-only functionality that was never meant to be remotely accessible. Successful exploitation compromises the confidentiality, integrity and availability of the orchestrator host and every SD-WAN edge and dataset it manages.
Affected: VeloCloud Orchestrator (VCO) On-Prem 5.2.x releases prior to 5.2.3.18; VeloCloud Orchestrator (VCO) On-Prem 6.1.x releases prior to 6.1.3.10; VeloCloud Orchestrator (VCO) On-Prem 6.4.x releases prior to 6.4.2.12; Hosted and Dedicated VCO were affected and have already been patched by Arista
How to Test
Check the VCO software version against the affected list: any 5.2.x build below 5.2.3.18, 6.1.x below 6.1.3.10, or 6.4.x below 6.4.2.12 is vulnerable; Arista has not assessed end-of-support versions, so treat those as affected. Because the attack path is any authenticated account escalating to the superuser operator, review orchestrator audit and access logs for operator-level or internal-only actions performed from customer/partner-level accounts, sessions attributed to the superuser operator from unexpected sources, and newly created or modified operator users or edge/profile configuration changes you cannot account for.
How to Patch
Upgrade VCO On-Prem to 5.2.3.18, 6.1.3.10, or 6.4.2.12 respectively. Hosted and Dedicated orchestrators have already been patched by Arista and need no customer action.