Critical VMware SD-WAN Orchestrator flaw actively exploited

Key Takeaways

• A critical SQL injection vulnerability (CVE-2026-114625) in VMware SD-WAN Orchestrator (VeloCloud Orchestrator) is under active exploitation.
• The flaw allows authenticated attackers, even those with low-privilege accounts, to escalate to superuser operator access.
• The vulnerability carries CVSS scores of 9.9 (v3.1) and 9.4 (v4.0), indicating severe risk.
• Arista Networks, the vendor, has released patches for affected on-premises deployments and has already secured hosted instances.
• Organizations should immediately patch and investigate for signs of compromise, blocking known malicious IP addresses.

Critical VMware SD-WAN Orchestrator Flaw Actively Exploited

A severe SQL injection vulnerability within VMware’s SD-WAN Orchestrator, formerly known as VeloCloud Orchestrator (VCO), is being actively exploited by malicious actors. This critical flaw allows authenticated users to elevate their privileges to superuser operator access, posing a significant risk to affected systems.

Arista Networks, the company behind the orchestrator, publicly disclosed the vulnerability on October 22, 2026. The company issued a stark warning that successful exploitation could lead to a complete compromise of the orchestrator, its underlying host infrastructure, and all managed data. Arista confirmed that its hosted deployments, including dedicated instances, have already received the necessary patches.

Understanding the Vulnerability: CVE-2026-114625

Identified as CVE-2026-114625, this flaw registers a critical CVSS v3.1 score of 9.9 and a CVSS v4.0 score of 9.4, reflecting its severe impact potential. Arista Networks not only discovered the issue but also confirmed ongoing exploitation in the wild.

Security Advisory 0199 identifies the weakness as CWE-89 (SQL injection) and tracks it internally under BUG2043622. While exploitation requires network access to the VCO web interface and a valid, authenticated portal session, attackers do not need administrative credentials. Even the lowest built-in tenant role, “Enterprise Read Only,” provides sufficient access to leverage the flaw. The attack itself is characterized by low complexity and requires no user interaction, making it particularly dangerous.

Successful exploitation grants an attacker operator privileges, enabling them to impersonate a local “superuser operator” account. This effectively bypasses intended security controls, exposing internal functions that should not be accessible remotely. Arista emphasizes that such a compromise can severely impact the confidentiality, integrity, and availability of both the orchestrator and the sensitive data it manages.

It’s crucial to note that this is not an unauthenticated attack; however, the requirement for only a limited account makes it a potent pathway to extensive system control.

Affected Versions and Remediation

Arista has confirmed that VCO is exposed by default, and no standard product configuration can eliminate this vulnerability. While restricting network access offers a temporary safeguard, it is not a permanent solution. This disclosure follows previous exploitation events involving separate command injection vulnerabilities in VeloCloud Orchestrator.

The vulnerability specifically impacts on-premises deployments of VCO. Affected versions include:

• VCO 5.2.x releases prior to 5.2.3.18
• VCO 6.1.x releases prior to 6.1.3.10
• VCO 6.4.x releases prior to 6.4.2.12

Administrators are strongly advised to upgrade to the fixed version within their specific release train or to a later, patched release. Arista has not evaluated software that has reached its end-of-support lifecycle.

It’s important for operators to verify the specific affected software list, as VeloCloud Gateway and VeloCloud Edge products are not impacted. Additionally, Arista’s EOS-based products and other named platforms are also unaffected by this particular vulnerability.

Indicators of Compromise (IoCs) and Mitigation

Arista has identified specific source IP addresses observed conducting attacks: 74.82.197.86 and 38.54.50.151. Security teams should immediately block these addresses and conduct thorough historical log reviews for any related activity.

Investigators should also look for unusual URL-like paths, encoded characters, references to local or internal services, and abnormally high request rates in their logs. Before applying remediation, it is advisable to preserve web access, backend application, system, and database logs, along with relevant file timestamps, where feasible.

What You Should Do

• Patch Immediately: Upgrade all affected on-premises VCO deployments to the recommended fixed versions (5.2.3.18, 6.1.3.10, 6.4.2.12, or later).
• Block Known Malicious IPs: Add 74.82.197.86 and 38.54.50.151 to your network’s blocklist.
• Hunt for Compromise: Review historical logs for any activity from the identified malicious IPs or other indicators of compromise (unusual URLs, encoded characters, high request rates).
• Restrict Network Access: Limit web access to the VCO interface to trusted administrative networks only.
• Monitor for Anomalies: Keep an eye on unexpected outbound connections, review recent administrator account changes, and scan for any backdoor services or webshells.
• Preserve Logs: Before remediation, save web access, backend application, system, and database logs, along with file timestamps, for forensic analysis.
• Contact Support: If your deployment is outside supported release trains, contact the Arista Technical Assistance Center for guidance on upgrade options.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.