A SQL injection turns any read-only VeloCloud Orchestrator login into the superuser

July 27, 2026. Arista patches an unauthenticated OS command injection in VeloCloud Orchestrator — CVE-2026-16812, a CVSS 10.0. September 22, 2026. A second zero-day, CVE-2026-93952, again CVSS 10.0. October 22, 2026. Advisory SA-0199 documents CVE-2026-114625, a SQL injection that is this time actively exploited and lifts a read-only account to superuser operator. The point is simple: this is the third time in four months the SD-WAN management plane has been targeted — and the third time there is no configuration workaround.

Privilege escalation with no exotic precondition

VeloCloud Orchestrator (VCO) is the management plane for VeloCloud SD-WAN. It holds the configuration of every Edge and Gateway in the estate, plus the tenant accounts through which customers, partners and MSPs read or change that configuration. It is exactly the piece an attacker wants: from there, the connectivity of every branch office falls in one move.

The flaw is a CWE-89 — a SQL injection tracked internally as BUG2043622. Per SA-0199 revision 1.0, “any authenticated user can gain operator privileges and masquerade as the local superuser operator user.” The functionality reached is “intended for internal use only” and is not meant to be remotely accessible.

The preconditions are two lines long. An attacker needs network access to the VCO web interface and a valid authenticated session on the portal. The minimum role is Enterprise Read Only — what Arista calls “the lowest built-in tenant role.” The weakest account the product offers is enough to own the whole product.

The CVSS v3.1 vector is unambiguous: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, scoring 9.9 (and 9.4 under CVSS 4.0). The PR:L encodes the only barrier — you must be logged in. The changed scope (S:C) says the rest: impact spills past the vulnerable component into the VCO host and the data it manages.

“Exposed by default,” and no setting stops it

The heaviest sentence in the advisory deserves a second read. Arista writes that VCO is “exposed by default” and that “there is no configuration that can prevent the exposure.” There is no switch to flip. Only an upgrade removes the flaw.

Fixes ship in the three supported trains:

• 5.2.x before 5.2.3.18 → upgrade to 5.2.3.18 or later in the 5.2 train.
• 6.1.x before 6.1.3.10 → upgrade to 6.1.3.10 or later in the 6.1 train.
• 6.4.x before 6.4.2.12 → upgrade to 6.4.2.12 or later in the 6.4 train.

Hosted and Dedicated instances were “impacted and have already been patched” by Arista, so the remaining work falls to organizations that run their own orchestrator. VeloCloud Gateway and VeloCloud Edge are not affected.

Two caveats the advisory leaves open. First, a VCO patched in September for the previous flaw may well be vulnerable again today, because the July and September fixes do not necessarily cover the same builds as the October one. Second, Arista does not say when exploitation began, how many orchestrators were hit, or what attackers did after gaining operator access — a silence The Hacker News and BleepingComputer both flagged.

The third zero-day in a series that tells a story

This is not an isolated accident. It is the third actively exploited VCO zero-day since late July 2026:

• CVE-2026-16812 (July 27): unauthenticated OS command injection, CVSS 10.0, added to the CISA KEV catalog the same day.
• CVE-2026-93952 (September 22): another CVSS 10.0, “known to be actively exploited,” also added to KEV.
• CVE-2026-114625 (October 22): a SQL injection, CVSS 9.9, actively exploited — but absent from KEV as of October 23.

That last gap is instructive. On October 23, 2026, the CISA ADP enrichment on the CVE record marked exploitation “none,” while Arista’s advisory of October 22 says the opposite. Until the two reconcile, the vendor advisory is the stronger signal — and it plainly says “exploited.”

For a CISO or SRE, the series tells one coherent story: the SD-WAN management plane has become a prime target because a single orchestrator often commands dozens of sites, and it frequently lives with MSPs that run the network for many customers. Compromise a VCO and you may compromise the connectivity of an entire portfolio.

What to do, in order

If you self-host a VCO, treat this as an emergency change, not a routine patch.

• Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 (or later in the same train). This is the only measure that actually removes the flaw.
• Restrict access to the VCO web interface to trusted administrative networks, and watch for the two source IPs Arista published as indicators: 74.82.197.86 and 38.54.50.151.
• Audit accounts. Because any user — read-only, partner or customer — can exploit the flaw, the attack surface is every VCO account, not just administrators. Remove stale or shared accounts, rotate credentials, and enforce MFA or SSO where your deployment supports it.
• Hunt for compromise before you patch: webshells, backdoor daemons, unusual outbound activity, recent administrator changes. Arista recommends preserving web access, application, system and database logs before remediation.

If you rely on an MSP or provider that runs VeloCloud for you, the useful question is not “do you use VeloCloud?” but “do you self-host a VCO, at what version, and have you audited who could log in?” A Hosted VCO is already patched: the risk concentrates on self-hosted instances.

Verdict

If you run an on-prem VCO, upgrade now and assume the flaw has already been attempted against you — the two published IP addresses are enough to justify a hunt through your logs. If you are an MSP customer, demand in writing the exact version of their orchestrator and proof that they have reviewed their accounts, because it is your connectivity on the line. The lasting lesson is not technical: a network management plane that is “exposed by default” is a standing invitation, and three zero-days in four months confirm it is no accident.

References

• Arista — Security Advisory 0199, revision 1.0 (October 22, 2026)
• Rescana — Arista VeloCloud Orchestrator CVE-2026-114625 (October 23, 2026)
• Safeguard — CVE-2026-114625 (October 23, 2026)
• BleepingComputer — Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
• The Hacker News — Arista warns of critical VeloCloud SQL injection zero-day exploited in attacks