The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, Arista disclosed an actively exploited critical SQL injection zero-day (CVE-2026-114625, CVSS 9.9) in the VeloCloud Orchestrator (VCO), the central management plane for VeloCloud SD-WAN networks. Any authenticated user—even one holding the lowest read-only customer role—could exploit the flaw to escalate to full operator-level privileges, potentially compromising the orchestrator host, its data, and downstream VeloCloud Edge devices. Fixes were released in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12; cloud-hosted instances were patched by Arista. Two attacker-controlled IPs were observed actively exploiting the vulnerability in the wild before the patch was available.

This is the third VCO zero-day exploited since July 2026, signaling a sustained, targeted campaign against SD-WAN management infrastructure. The pattern—unauthenticated flaws followed by an authenticated privilege-escalation bug—suggests attackers are systematically mapping and chaining VCO weaknesses to achieve persistent, high-privilege control over enterprise network fabrics at scale.

Why This Matters Now

SD-WAN orchestrators are high-value, internet-exposed control planes governing thousands of enterprise branch and cloud sites. Three exploited VCO zero-days in under four months demonstrate that threat actors are prioritizing network management layer compromise as a force-multiplier attack vector. Organizations that have not yet patched—or that lack compensating controls around orchestrator access—face immediate risk of full network takeover and data exposure.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

CVE-2026-114625 is a SQL injection flaw that allows any authenticated VCO user—even those with the lowest read-only role—to escalate privileges to operator level, gaining full administrative control over the orchestrator, its managed SD-WAN edges, and potentially the underlying host system.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant here because the attacker's ability to reach the VeloCloud Orchestrator from public IPs, escalate within a flat management plane, and pivot freely to downstream Edge devices reflects the absence of identity-aware segmentation and controlled access paths. By enforcing network-layer segmentation and restricting reachability to the orchestrator and its connected infrastructure, CNSF would likely reduce the attacker's operational reach and limit the blast radius across managed customer tenants.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Network-layer access to the orchestrator management interface from untrusted external source IPs would likely be constrained, reducing the reachability of attacker-controlled endpoints to the vulnerable SQL injection entry point and narrowing the exploitable attack surface.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Even following a successful application-layer privilege escalation, Zero Trust segmentation would likely constrain what the newly elevated attacker identity could reach within the environment, reducing the scope of network resources accessible from the compromised orchestrator host.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to move freely between the orchestrator segment and Edge device segments or connected cloud workloads, constraining lateral reachability even when the attacker holds valid operator credentials within the management plane.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized multicloud visibility over east-west and north-south traffic flows originating from the orchestrator workload would likely surface anomalous outbound connection attempts earlier, and policy enforcement at the fabric level could constrain unauthorized outbound paths used for C2 beaconing.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress policy enforcement would likely constrain the outbound data paths available to the attacker, reducing the volume and variety of data that could be transferred from the orchestrator environment to external attacker-controlled destinations without triggering policy violations.

Impact (Mitigations)

If prior CNSF controls meaningfully constrained lateral movement and egress paths, the attacker's ability to reach all managed Edge devices and execute tenant-wide disruption would likely be reduced, limiting the realized blast radius to segments where the attacker maintained persistent reachability rather than the full orchestrator-managed tenant population.

Impact at a Glance

Affected Business Functions

  • SD-WAN Network Orchestration and Policy Management
  • Enterprise Branch Connectivity and Traffic Routing
  • Customer and Partner Network Configuration Administration
  • VeloCloud Edge Device Fleet Management
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: N/A

Data Exposure

Full compromise of VeloCloud Orchestrator exposes all managed SD-WAN configuration data including network topology, routing policies, VPN credentials, customer and partner account credentials, and administrative audit logs. Attackers acting as local superusers may exfiltrate proprietary enterprise network architecture details, modify routing policies to redirect or intercept traffic, plant persistent backdoors or webshells on the VCO host, and potentially pivot to connected VeloCloud Edge devices across all managed customer networks. The breadth of exposure spans all tenants managed by a compromised orchestrator, making this a multi-tenant supply-chain style risk for managed service providers and enterprises relying on VeloCloud SD-WAN infrastructure.

Recommended Actions

  • • Apply CNSF Cloud Firewall (ACF) and Egress Security controls immediately to restrict inbound access to the VCO web interface to trusted administrative networks only and block outbound connections from VCO hosts to unauthorized destinations, directly addressing Arista's interim mitigation guidance and limiting attacker C2 and exfiltration channels.
  • • Deploy Inline IPS (Suricata) with updated signatures for CVE-2026-114625 SQL injection patterns to detect and block exploitation attempts against VCO web interfaces, including requests with unusual URL path components, encoded characters, and high-rate automated probing from known attacker IPs.
  • • Enforce Zero Trust Segmentation to isolate the VeloCloud Orchestrator from general network access, applying least-privilege identity-based policies so that only explicitly authorized administrative identities and source networks can reach the VCO management plane, preventing low-privilege account abuse.
  • • Enable Multicloud Visibility and Threat Detection controls (ThreatIQ/ThreatGuard) to baseline normal VCO traffic patterns and alert on anomalous interactions such as repeated malformed requests, connections from flagged IPs (74.82.197[.]86, 38.54.50[.]151), unexpected outbound activity, or unusual administrator actions indicative of post-exploitation behavior.
  • • Activate Encrypted Traffic (HPE) protections using MACsec or IPsec for all data-in-transit between VCO, Edge devices, and managed infrastructure to prevent interception of SD-WAN configuration and customer data during and after orchestrator compromise, and implement East-West Traffic Security controls to contain lateral movement from a compromised VCO host toward Edge devices and customer network segments.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image