Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)

A critical flaw tracked as CVE-2026-114625 threatens on-premises instances of Arista VeloCloud Orchestrator. This Arista VeloCloud Orchestrator SQL injection vulnerability carries a near-maximum CVSS score of 9.9, reflecting how easily low-privileged access can be leveraged to compromise the broader host environment and SD-WAN infrastructure.

Technical Exploitation Path

The flaw stems from improper input handling within database queries (CWE-89) in the on-premises orchestrator interface. Exploitation requires minimal setup: an attacker needs only low-privilege access (PR:L)—such as a standard tenant or restricted user account—and no user interaction (UI:N) to send malicious payloads across the network (AV:N).

While measured EPSS probability sits at 0.56% (the 45.6th percentile of all CVEs), the metric that demands immediate attention is the CVSS Scope Change (S:C). In central management consoles like VeloCloud Orchestrator, breaking out of the application’s database boundary typically allows an attacker to interact with the underlying operating system or write arbitrary files to disk. Once an attacker leverages a database injection to gain root-level execution on the host, they move beyond the application layer and gain full control over confidentiality, integrity, and availability (C:H/I:H/A:H).

Exposure Profile and Impact

On-premises installations of VeloCloud Orchestrator managing enterprise SD-WAN deployments represent high-value targets. Because the orchestrator acts as the centralized control plane for configuration, routing policies, and tunnel management across edge devices, compromising the host grants wide-ranging visibility and operational control over an enterprise’s entire network architecture.

An attacker who successfully exploits this SQL injection can:

• Extract cryptographic material, service credentials, and network configuration data from the backend database.
• Execute system commands via database extension functions, escalating privileges directly on the underlying host.
• Intercept, reroute, or drop traffic flowing across managed VeloCloud Edge devices by altering central configuration policies.

Organizations with management interfaces exposed directly to broad internal subnets or the open internet face the highest risk of automated discovery and targeted exploitation.

Remediation and Response

Organizations deploying on-premises Arista VeloCloud Orchestrator instances should immediately prioritize remediation:

• Apply vendor-supplied security patches to all on-prem VCO hosts to neutralize the unsafe SQL query handling.
• Restrict access to VCO management and API endpoints using strict network segmentation, permitting access only via secure, dedicated management networks or jump hosts.
• Review role-based access control (RBAC) configurations and conduct an immediate audit of standard and low-privileged user accounts capable of querying backend interfaces.
• Execute forensic triage and review database and system access logs for anomalous database error patterns or privilege escalation attempts, in line with CISA BOD 26-04 requirements for impacted assets.