Arista patches exploited VeloCloud Orchestrator privilege escalation flaw

Arista released security updates for an actively exploited vulnerability affecting on-premises VeloCloud Orchestrator deployments, BleepingComputer reported on October 22. Tracked as CVE-2026-114625, the SQL injection flaw allows attackers with basic privileges, web-interface access, and a valid authenticated session to escalate privileges without user interaction.

VeloCloud Orchestrator manages SD-WAN networks and associated edge devices, placing this flaw in the network’s control room. Arista said any authenticated user on an affected system could gain operator privileges and masquerade as a local superuser operator. The vendor’s warning, reproduced in the report, describes potential compromise of the orchestrator and its managed data.

Pending patch deployment, Arista’s reported guidance recommends restricting the web interface to administrative networks, reviewing administrator activity, and checking access logs for suspicious requests. It also advises preserving relevant logs and filesystem timestamps before remediation where operationally feasible if compromise is suspected, and contacting its Technical Assistance Center for help.