Arista Networks has shipped fixes for a zero-day in VeloCloud Orchestrator that it says is already being exploited, the third such flaw in the SD-WAN management tool in four months.
The defect, CVE-2026-114625, is a SQL injection rated 9.9. On an on-premises orchestrator, any authenticated user can climb to operator privileges and pass as the local superuser, reaching internal functionality the product never meant to expose remotely. Arista warned that confidentiality, integrity and availability of the orchestrator and its data are all in scope.
No setting turns it off
The company was direct about the exposure. Orchestrator deployments are reachable by default, attackers need only the web interface and a valid session, and the lowest built-in tenant role is sufficient. There is no configuration that prevents it.
That matters for managed service providers, who commonly hand customers limited tenant accounts on a shared orchestrator. A read-only login is now an escalation path, not a containment boundary.
Arista detected the issue itself and reports exploitation from two addresses, 74.82.197.86 and 38.54.50.151. It advises blocking them and hunting logs for unusual request volume, URL-like path components, encoded characters and references to internal services. Where compromise is suspected, preserve web access, backend application, system and database logs before rebuilding.
The patched versions
Everything before 5.2.3.18, 6.1.3.10 and 6.4.2.12 is affected. Hosted deployments are already fixed, so the outstanding work sits with organisations running the orchestrator on their own hardware.
Four months, three exploited orchestrator zero-days. Teams running VeloCloud should treat internet-facing management planes as a standing attrition problem rather than a one-off patching exercise, and put the orchestrator behind an access proxy whose logging survives the host.
