A critical flaw in Arista's VeloCloud Orchestrator is being exploited in the wild

Key points

• The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-114625, a critical flaw in Arista's VeloCloud Orchestrator, to its Known Exploited Vulnerabilities list on 22 October 2026 after seeing attackers use it in real networks.
• Scoring 9.4 out of 10 on the standard severity scale, the flaw lets any logged-in user quietly promote themselves to the top "superuser operator" account.
• Arista's hosted and Dedicated versions of the Orchestrator have already been patched; on-premises customers still have to fix it themselves.
• Federal civilian agencies are required by Binding Operational Directive 26-04 to patch exposed systems quickly and to check whether attackers were already inside before the fix was applied.
• CISA's advisory describes the bug as a SQL injection: a classic web flaw where a login form or similar input is tricked into running database commands it shouldn't.

Arista's VeloCloud Orchestrator is the control panel for SD-WAN, a corporate networking approach that connects branch offices and cloud services over ordinary internet links. Control the orchestrator and you control the whole wide-area network from a single screen. That system is now on CISA's exploited list.

This isn't the first time we've had to write about this product. Our 22 September story covered a separate VeloCloud flaw where a remote attacker needed no login at all. This one requires a login, but barely raises the bar.

The bug scores 9.4 out of 10. Any user who can log in at all can promote themselves to a built-in "superuser operator" account and reach internal features never meant to be exposed to customers, let alone the open internet.

CISA calls it a SQL injection vulnerability. One of the oldest tricks on the web: a form field or URL parameter gets passed straight into a database query, so an attacker types something that looks like data but is actually a command. The database obeys. Here the payoff isn't stolen rows from a web shop but full operator rights over a networking appliance.

Who is affected?

The on-premises build of VeloCloud Orchestrator is what customers need to worry about. Arista's hosted service, including the Dedicated tier, has already been patched on the company's side, according to the vendor's writeup referenced in the National Vulnerability Database entry. If you run the software yourself, the fix is on you.

How bad is it in practice?

Bad, because the attacker barely has to work for it. "Any authenticated user" can escalate, the advisory says. That phrase carries weight. A low-value account belonging to a contractor or a dormant reseller login is enough to end up with god rights over the box. From there, the orchestrator's reach over confidentiality and availability is entirely in play, along with everything it manages.

CISA doesn't name the attackers or the victims. What the listing confirms is that someone has already pulled this off against a real target. That is the bar for the Known Exploited Vulnerabilities list.

What should defenders do now?

Patch the on-prem Orchestrator to the fixed build Arista has published, then go back through the logs. Federal civilian agencies have to do this on a clock under Binding Operational Directive 26-04, and the directive explicitly requires them to check for signs of prior intrusion, not just apply the update and move on. Everyone else should treat that as the sensible default.

Calling this an "AI-era" or "next-generation" attack would be nonsense. It's SQL injection in a login path on a network management box in 2026. What's worth watching isn't the technique, which is ancient. It's that a product sitting at the centre of corporate networks shipped with this class of flaw, and attackers found it before defenders did.