Ethical Hacking News
A critical VeloCloud SQL injection zero-day flaw has been exploited in attacks, allowing attackers to gain operator privileges and control over the VeloCloud Orchestrator. Arista has patched releases for VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, but customers are advised to take steps to limit access and monitor for suspicious activity. The advisory highlights the importance of regular security updates and patches for enterprise security, and emphasizes the need for vigilance and quick action in responding to security threats.
Arista warns of a critical VeloCloud SQL injection zero-day flaw (CVE-2026-114625) that allows attackers to gain operator privileges. The flaw can be exploited by anyone who can log in to the VeloCloud Orchestrator, regardless of their role or level of access. VCO is exposed by default and no VCO setting prevents the exposure. Patched releases are available, but some older releases may still be vulnerable. Customers should limit access to the VCO web interface, monitor for suspicious activity, and block outbound ports as recommended by Arista. Customers should also check web access logs for unusual requests and save evidence in case of a suspected compromise.
A recent advisory issued by Arista warns of a critical VeloCloud SQL injection zero-day flaw that has been exploited in attacks. The flaw, tracked as CVE-2026-114625, allows an attacker to gain operator privileges, the top level of control over the VeloCloud Orchestrator, even with a read-only customer account. This advisory marks the third in VCO since late July that Arista has reported as exploited, and the first of the three that requires a login.
The VeloCloud Orchestrator is the central management system for VeloCloud SD-WAN networks, and the flaw can be exploited by anyone who can log in to the orchestrator, regardless of their role or level of access. The advisory notes that the flaw can be exploited by an attacker who needs network access to the orchestrator's web interface and a valid login, with the minimum role being Enterprise Read Only, the lowest built-in role for customer users.
The advisory also notes that VCO is exposed by default, and no VCO setting prevents the exposure. The flaw allows an attacker to act as a local superuser, a role with full access to the orchestrator, and may also allow an attacker to affect the VCO host itself and expose, modify, or disrupt the orchestrator and the data it manages.
Arista has patched releases for VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, with Hosted and Dedicated orchestrators already being patched. However, releases that have not been patched, such as those that fixed the September flaw, are still vulnerable. The advisory recommends that customers limit access to the VCO web interface to trusted administrative networks, monitor the VCO for connections from known malicious IP addresses, watch for unexpected outbound network activity from the VCO host, and consider blocking outbound ports that normal operation does not need.
In addition to the steps recommended by Arista, customers should also check VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates. If a customer suspects a compromise, they should save evidence before fixing anything, including the VCO web access, backend application, system and database logs, along with the relevant file-system timestamps.
The advisory also notes that the risk of a compromised orchestrator granting attackers access to VeloCloud Edge devices applies to this flaw, but the advisory does not say whether the risk applies or whether upgrading removes access that an attacker has already gained.
The third VeloCloud SQL injection zero-day flaw reported by Arista since late July, this advisory highlights the importance of regular security updates and patches for enterprise security. The fact that the flaw can be exploited by an attacker with a read-only customer account, and that VCO is exposed by default, emphasizes the need for a robust security posture.
The advisory is a reminder that even seemingly secure systems can be vulnerable to exploitation, and that vigilance and quick action are essential in responding to security threats. As the threat landscape continues to evolve, it is crucial that organizations prioritize their security posture and stay informed about the latest vulnerabilities and exploits.
Related Information:
https://www.ethicalhackingnews.com/articles/Arista-Warns-of-Critical-VeloCloud-SQL-Injection-Zero-Day-Flaw-Implications-for-Enterprise-Security-ehn.shtml
https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html
Published: Thu Oct 22 15:39:57 2026 by llama3.2 3B Q4_K_M
