Critical SQL Injection Flaw Exploited in Arista VeloCloud SD-WAN

A critical zero-day vulnerability in Arista's VeloCloud Orchestrator (VCO) is being actively exploited by attackers. The SQL injection flaw enables unauthorized users, including those with read-only access, to escalate their privileges to the highest operator level within the SD-WAN management system.

This vulnerability poses a significant risk to organizations relying on Arista's SD-WAN solutions, as it compromises the central orchestration layer that manages network policies and device configurations across distributed infrastructures. The flaw underscores the importance of continuous monitoring and rapid patch deployment for infrastructure-level applications.

Vulnerability Details

• The flaw is a SQL injection vulnerability in the VeloCloud Orchestrator login process
• It allows privilege escalation from any authenticated user, including read-only accounts
• Successful exploitation grants operator-level privileges, the highest access tier in VCO
• The vulnerability affects the central management plane of SD-WAN deployments
• Arista has assigned internal tracking ID VCO-2026-001 to the issue

Impact and Recommendations

• Organizations using VeloCloud Orchestrator should assume compromise if unpatched systems are exposed
• Immediate mitigation includes restricting access to the orchestrator interface and monitoring for suspicious activity
• Arista recommends applying available patches and implementing network segmentation around VCO instances
• Security teams should audit user accounts and permissions within affected VCO deployments
• Long-term remediation requires updating to patched versions and reviewing SD-WAN security posture

Sources

• Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks