Arista Fixes Actively Exploited SQL Injection in VeloCloud Orchestrator On-Prem

VeloCloud SQL fixes from Arista address the critical CVE-2026-114625 vulnerability in VeloCloud Orchestrator (VCO) On-Prem, which is reportedly being actively exploited in attacks. The SQL injection flaw could allow an authenticated user, including an account with the Enterprise Read Only role, to gain operator privileges.

The risk affects on-premises VCO deployments, meaning systems operated directly by an organization. Hosted versions, including Dedicated, were reportedly fixed before information about the flaw was published.

VeloCloud SQL fixes are available for three branches

The fix is available in the following VCO releases:

• VCO 5.2.3.18 and later,
• VCO 6.1.3.10 and later,
• VCO 6.4.2.12 and later.

CVE-2026-114625 is classified as SQL injection and tracked under CWE-89. According to the cited technical information, an attacker does not necessarily need an account with administrator-level access: exploitation requires an authenticated user, but the low-privilege Enterprise Read Only role is reportedly affected as well. The result could be escalation to operator privileges.

VCO is used to centrally manage SD-WAN environments. Gaining operator privileges therefore poses a high risk to organizations that manage Edge devices through an on-premises orchestrator. A compromised account with limited privileges could provide a path to central management of this infrastructure and potentially affect managed devices.

Restricting access and checking logs

Arista recommended that operators restrict access to the VCO web interface to trusted administrative networks. Organizations should also review access and system logs for signs of possible compromise.

Because this is manufacturer-reported active exploitation, deploying the relevant fixed version is the priority for affected on-premises installations. If compromise is suspected, credential rotation should also be considered. Restricting network access alone does not replace a software update, but it may narrow the range of systems and users able to reach the administrative interface.

What has not been confirmed yet

It has not been independently confirmed who is conducting the attacks, how many organizations have been affected, or when the exploitation began. The direct primary-source wording of Arista’s security alert identified as Security Advisory 0199 could not be independently verified either. The technical details of the flaw, the scope of affected versions, and the recommended steps are based on multiple secondary reports that cite the alert.

Further developments could bring an updated Arista security alert, possible inclusion of CVE-2026-114625 in the CISA Known Exploited Vulnerabilities catalog, or the publication of indicators of compromise and information about the scope of the attacks.

Verified and updated: 10/23/2026 06:19