CVE-2026-114625: How Attackers Are Exploiting Arista VeloCloud Orchestrator to Own Your SD-WAN
Executive Summary
In October 2026, Arista Networks disclosed and patched CVE-2026-114625, a critical zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments that was already being actively exploited in the wild. The flaw allows any authenticated user with basic privileges and access to the VCO web interface to escalate to operator-level privileges via low-complexity SQL injection, effectively masquerading as a local superuser. Attackers leveraging IP addresses 74.82.197.86 and 38.54.50.151 were observed exploiting the flaw, threatening the confidentiality, integrity, and availability of SD-WAN infrastructure and all data managed by the orchestrator. This is the fourth actively exploited zero-day patched by Arista in 2026 alone.
This incident underscores a persistent and accelerating pattern: management-plane and orchestration-layer vulnerabilities in SD-WAN and network infrastructure are prime targets for threat actors. As enterprises consolidate network control into centralized orchestrators, a single privilege escalation flaw can hand attackers keys to the entire wide-area network, making rapid patch cadence and layered runtime controls non-negotiable.
Why This Matters Now
SD-WAN orchestrators like VCO sit at the nerve center of enterprise networking, controlling thousands of edge devices across hybrid and multi-cloud environments. CVE-2026-114625 is the fourth actively exploited Arista zero-day in 2026, signaling sustained adversary focus on network control planes. With only 37% of post-credential actions blocked on average, organizations relying solely on perimeter patching face severe residual risk.
Attack Path Analysis
Attackers with basic authenticated access to the VeloCloud Orchestrator web interface exploited CVE-2026-114625, a critical SQL injection zero-day, to escalate privileges to superuser operator level and gain access to internal orchestrator functionality. From that privileged foothold, adversaries likely pivoted across managed SD-WAN edge devices, established persistent command-and-control channels, and exfiltrated configuration data and credentials managed by the orchestrator, ultimately threatening the confidentiality, integrity, and availability of the entire SD-WAN fabric.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers obtained a valid authenticated session to the VeloCloud Orchestrator web interface, likely through credential theft, phishing, or brute force against an internet-exposed VCO management portal. Known malicious IPs 74.82.197.86 and 38.54.50.151 were observed initiating connections, suggesting coordinated scanning and exploitation activity targeting exposed VCO deployments.
Related CVEs
CVE-2026-114625
CVSS 9.9A critical SQL injection vulnerability in Arista VeloCloud Orchestrator (VCO) On-Prem allows any authenticated remote attacker with low privileges to escalate to operator/superuser privileges through low-complexity attacks requiring no user interaction, potentially compromising confidentiality, integrity, and availability of the orchestrator and managed SD-WAN infrastructure.
Affected Products:
Arista Networks VeloCloud Orchestrator (VCO) On-Prem – < 5.2.3.18, < 6.1.3.10, < 6.4.2.12
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts
Abuse Elevation Control Mechanism
Server Software Component: Web Shell
Cloud Administration Command
Brute Force
Impair Defenses: Disable or Modify Tools
Data from Cloud Storage
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Timely Patching of Vulnerabilities
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Access Privileges and Least Privilege
Control ID: Section 500.7
DORA (Digital Operational Resilience Act) – Vulnerability and Patch Management
Control ID: Article 9 — ICT Security Policies
CISA ZTMM 2.0 – Network Access Restriction and Segmentation
Control ID: Pillar 3 — Networks: Macro/Micro Segmentation
NIS2 Directive – Vulnerability Management and Incident Reporting
Control ID: Article 21(2)(e) — Vulnerability Handling and Disclosure
ISO/IEC 27001:2022 – Management of Technical Vulnerabilities
Control ID: Annex A 8.8
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
VeloCloud Orchestrator SD-WAN privilege escalation via SQL injection directly threatens IT infrastructure teams managing on-prem deployments, risking full orchestrator compromise, lateral movement, and loss of network control plane integrity.
Computer Networking
SD-WAN orchestration platforms are foundational networking assets; CVE-2026-114625 allows authenticated attackers to seize superuser operator privileges, undermining zero trust segmentation and east-west traffic security across managed edge environments.
Financial Services
Financial institutions relying on VeloCloud SD-WAN for branch connectivity face critical exfiltration and privilege escalation risks, with PCI 4.0 and NIST 800-53 compliance implications from unmitigated orchestrator compromise and data confidentiality loss.
Telecommunications
Telecom providers managing large-scale SD-WAN edge deployments for enterprise customers face cascading exposure; attacker superuser masquerading threatens multi-tenant orchestration integrity, violating ZTMM network segmentation and encrypted transit compliance mandates.
Sources
- Arista patches new VeloCloud Orchestrator zero-day exploited in attackshttps://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/Verified
- Arista Security Advisory 0199 - CVE-2026-114625 VeloCloud Orchestrator Privilege Escalationhttps://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199Verified
- Arista patches actively exploited VeloCloud Orchestrator zero-day (CVE-2026-93952) - BleepingComputerhttps://www.bleepingcomputer.com/news/security/arista-patches-actively-exploited-velocloud-orchestrator-zero-day/Verified
- Arista Security Advisory 0137 - CVE-2026-7473https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the VeloCloud Orchestrator was internet-exposed and trusted implicitly by all managed SD-WAN edge devices, giving authenticated attackers broad, unconstrained reach across the fabric. A Zero Trust segmentation model would likely reduce the blast radius by limiting which sources could reach the orchestrator management plane and constraining the orchestrator's ability to propagate attacker access laterally across edge nodes.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Internet reachability to the VCO management plane would likely be constrained, reducing the attacker's ability to establish an initial authenticated session from untrusted external sources.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely reduce the scope of what an escalated superuser session could access by enforcing workload-level boundaries, limiting how far elevated credentials could be leveraged across the orchestrator environment.
Control: East-West Traffic Security
Mitigation: East-west enforcement would likely constrain the attacker's ability to pivot freely from the orchestrator to managed edge devices, reducing the lateral reach achievable through the orchestrator's administrative trust relationships.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility would likely surface anomalous outbound communication patterns from the orchestrator, and policy enforcement could reduce the attacker's ability to maintain reliable C2 channels through unmonitored paths.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policy enforcement would likely reduce the attacker's ability to exfiltrate sensitive orchestrator data, including device credentials and network configurations, by constraining which outbound destinations the orchestrator is permitted to reach.
If prior Zero Trust segmentation and egress controls had been applied, the attacker's ability to propagate configuration manipulation and persistent access across thousands of managed edge devices would likely have been significantly reduced in scope.
Impact at a Glance
Affected Business Functions
- SD-WAN Network Orchestration and Management
- Enterprise Branch Connectivity and Edge Device Configuration
- Network Administrator Access Control and Identity Management
- SD-WAN Policy Enforcement and Traffic Routing
Estimated downtime: 7 days
Estimated loss: N/A
Successful exploitation grants attackers superuser-level access to the VeloCloud Orchestrator platform, exposing the full configuration and operational data of managed SD-WAN deployments. At risk are network topology maps, edge device credentials, routing policies, administrative user credentials, internal API keys, VPN tunnel configurations, and any sensitive organizational network data stored or managed through the orchestrator. For Arista's customer base of over 10,000 organizations, a compromised orchestrator could expose multi-site enterprise WAN infrastructure, enabling adversaries to intercept, reroute, or disrupt business-critical network traffic across all connected branch locations.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation (microsegmentation and identity-based policy) to restrict VCO web interface access strictly to authorized administrative networks and identities, eliminating broad authenticated access that enabled CVE-2026-114625 privilege escalation exploitation.
- • Deploy Multicloud Visibility & Control to establish behavioral baselines for VCO management API activity, enabling detection of anomalous interactions, high request rates, unusual URL-path components, and repeated malformed requests indicative of SQL injection probing and superuser masquerading.
- • Enforce East-West Traffic Security controls between the VCO orchestrator and managed SD-WAN edge devices to monitor and restrict workload-to-workload and service-to-service communications, containing lateral movement from a compromised orchestrator to downstream edge infrastructure.
- • Implement Egress Security & Policy Enforcement with FQDN filtering and outbound traffic controls on the VCO host to detect and block unauthorized outbound data flows to attacker-controlled destinations, preventing exfiltration of orchestrator-managed configuration data and credentials to IPs such as 74.82.197.86 and 38.54.50.151.
- • Leverage Inline IPS (Suricata) with CVE-specific signatures for SQL injection exploit patterns against web application interfaces to identify and block malicious payloads targeting the VCO web interface before privilege escalation succeeds, complementing patch management with runtime exploit prevention.
