SQL Injection Flaw in Arista VeloCloud Orchestrator Exploited

TL;DR

• A critical SQL injection vulnerability in Arista VeloCloud Orchestrator on-premise instances allows remote attackers to compromise centralized SD-WAN management hosts [^1].
• CISA added the flaw to its Known Exploited Vulnerabilities catalog following reports of active threat actor targeting against unpatched enterprise deployments [^1] [^2].

Background

Software-Defined Wide Area Networking (SD-WAN) enables enterprise organizations to manage complex networks across hundreds of branch offices through a centralized software management plane. Arista VeloCloud Orchestrator serves as this central management node, providing network engineers with a unified web console to push routing policies, manage IPsec tunnels, and deploy firewall rules to edge devices. Because the orchestrator holds full administrative control over every connected network node, compromising this central host grants an adversary operational control over all enterprise traffic crossing the WAN infrastructure.

What happened

Security researchers uncovered a severe SQL injection vulnerability in on-premise installations of Arista VeloCloud Orchestrator, tracked under the catalog identifier CVE-2026-114625 [^1]. The security flaw originates from improper input validation within the orchestrator's web interface software components, where user-controlled parameters are concatenated directly into raw database queries without adequate sanitization or parameterized abstraction [^1]. This oversight allows unauthenticated remote attackers to inject custom SQL directives directly through exposed web application endpoints [^1] [^2].

When the underlying database engine executes these manipulated requests, the injection payload breaks out of the application's intended query structure [^1]. An attacker can read, alter, or delete internal database tables that store core operational state, administrator session tokens, and encrypted configuration parameters [^1] [^2]. In advanced exploitation scenarios, attackers can leverage database permissions to execute system-level operational commands on the hosting operating system, escalating access from a simple web query into remote code execution with elevated root or system privileges [^2].

The Cybersecurity and Infrastructure Security Agency (CISA) responded by adding CVE-2026-114625 to its Known Exploited Vulnerabilities catalog, confirming that malicious actors are actively exploiting this bug in live production environments [^1]. Threat telemetry indicates that adversary groups are utilizing automated scanning scripts to identify public-facing VeloCloud Orchestrator web portals across corporate IP ranges [^1] [^2]. Once a target is discovered, the automated tools execute injection payloads designed to extract administrative credentials, bypass authentication filters, and establish persistent backdoors directly on the management host [^1].

Why it matters

Centralized management orchestrators represent prime targets for sophisticated threat actors because they function as keys to the corporate network kingdom. In modern cloud-assisted networks, security teams rely on orchestrators to enforce zero-trust policies, manage network segmentation, and handle internal encryption key distribution. When an adversary compromises the orchestrator, every security policy enforced by that software becomes completely untrusted. The attacker can modify routing tables to divert confidential internal traffic to rogue listening posts, inject malicious code updates into branch routers, or disable intrusion prevention systems without alerting security teams.

Furthermore, this vulnerability underscores the extreme operational risks associated with exposing critical management planes to external network interfaces. SQL injection vulnerabilities remain one of the oldest and best-understood bug classes in software engineering, making their presence in critical enterprise security infrastructure particularly damaging. Organizations that deploy on-premise management appliances frequently assume internal deployment provides intrinsic safety, yet operational mistakes or misconfigured firewall rules often leave administrative portals reachable from the internet. When an unauthenticated flaw of this magnitude exists, a single exposed port allows external threat actors to completely bypass traditional perimeter defenses.

Enterprise IT departments running on-premise VeloCloud Orchestrator appliances must act immediately. Organizations need to restrict access to management interfaces using strict access control lists or VPN requirements, conduct forensic audits of system logs to check for indicators of compromise, and apply official software updates issued by Arista to remediate the underlying code defects [^1] [^2].

Practical example

Imagine you are the principal network engineer for a retail company managing two hundred stores. Your team uses an on-premise Arista VeloCloud Orchestrator server to push policy updates to routers at every branch location.

On a Friday night, an automated scanner discovers your orchestrator's web management portal exposed on a public IP address. The script sends an HTTP request containing a malicious SQL injection payload directly into an unvalidated parameter on the web page.

The underlying database executes the command, dumping hashed administrative credentials to the attacker's machine. The attacker cracks the primary password, logs into the central console, and issues a malicious configuration script to all two hundred store routers. By Saturday morning, internal network traffic is silently redirected to an adversary-controlled server, transforming your central orchestrator into a corporate-wide breach vector.

Related gear

We recommend this book because it provides a comprehensive breakdown of SQL injection mechanics and practical techniques for securing database-driven applications.