Arista patches third VeloCloud zero-day in 87 days as SQL flaw elevates read-only tenants to host superuser

Three zero-days in 87 days

Three actively exploited zero-day vulnerabilities have struck Arista VeloCloud Orchestrator in 87 days. Between 27 July 2026 and 22 October 2026, the centralised software-defined wide area network (SD-WAN) management platform has suffered an average of one newly exploited zero-day flaw every 43.5 days (derived). The latest vulnerability, tracked as CVE-2026-114625 and documented in Arista Security Advisory 0199, carries a CVSSv3.1 base score of 9.9 and a CVSSv4.0 score of 9.4. It allows an authenticated remote attacker to execute arbitrary SQL commands against the orchestrator database and immediately assume local superuser operator privileges on the underlying host operating system.

That finding establishes an aggressive cadence of in-the-wild exploitation against central SD-WAN management appliances. It does not establish the identity, attribution, or national sponsorship of the intrusion groups exploiting the defect. It does not state how many enterprise customer deployments were compromised prior to Arista's detection. Nor does the official record establish whether adversaries used their operator-level access to reconfigure connected branch edges, alter BGP routing tables, or intercept cleartext network traffic traversing customer tunnels.

What the official advisory establishes and what it leaves unstated

Enterprise security teams assessing the severity of Advisory 0199 must separate verified engineering statements from assumptions. Arista provides technical clarity regarding affected versions and the exploit mechanism, while withholding campaign details and customer incident counts.

Comparison of facts explicitly confirmed in Arista Advisory 0199 versus unstated operational details

Operational Domain	Explicitly Confirmed in Advisory 0199	Not Stated in the Official Record
Exploitation State	Actively exploited in the wild prior to patch release; detected directly by Arista Networks.	Threat actor identity, campaign names, initial discovery date, and historical dwell time.
Prerequisites	Network reachability to web portal and an active session as Enterprise Read Only.	Whether observed intrusions used stolen customer credentials, brute force, or third-party session hijacking.
Technical Vector	CWE-89 SQL injection flaw in backend database logic, tracked internally as BUG2043622.	The specific API endpoint, vulnerable database table, or parameter name handling the unvalidated input.
Blast Radius	Allows full masquerading as a local superuser operator and access to internal daemon functionality.	Whether threat actors modified routing configurations or exfiltrated keys from connected VeloCloud Edges.
Remediation	Upgrade to 5.2.3.18, 6.1.3.10, or 6.4.2.12; apply network access restrictions.	Availability of hotfixes or backported patches for end-of-support (EOS) software releases.

The friendly-name fallacy: how Enterprise Read Only becomes host root

The architectural failure in CVE-2026-114625 exemplifies the friendly-name fallacy in enterprise role-based access control (RBAC). In modern multi-tenant management platforms, the role Enterprise Read Only is positioned as a benign permission tier: a view-only account granted to junior helpdesk analysts, external auditors, or automated monitoring sensors. Deployers assume that assigning a read-only role contains risk because the user has no permissions to write configuration changes.

In BUG2043622, the application's underlying code does not treat the read-only user as untrusted. When an authenticated user submits input to the orchestrator web interface, unsanitised parameters are passed directly into SQL query constructors. Because database queries execute with the authority of the application service account rather than the constrained session context, the attacker uses standard SQL injection techniques to break out of tenant isolation, alter system authorization tables, and issue remote procedure calls to local management daemons that were never intended to be exposed to network clients.

Zoom

As illustrated in the diagram, once the database boundary is breached, the attacker achieves the role of local superuser operator. In VeloCloud terminology, an operator is not merely an enterprise customer administrator; an operator represents the service provider tier with global governance across all tenant partitions, edge licensing, and underlying Linux operating system services.

Three quarterly zero-days: tracing the 87-day escalation path

The disclosure of CVE-2026-114625 cannot be understood in isolation. It forms the third chapter in an escalating sequence of zero-day discoveries targeting VeloCloud Orchestrator:

Chronological audit of in-the-wild zero-day vulnerabilities in VeloCloud Orchestrator (July to October 2026)

Disclosure Date	Identifier	Vulnerability Class	CVSS Score	Prerequisites for Exploitation
27 July 2026	CVE-2026-16812	CWE-78: OS Command Injection	10.0 (Critical)	Unauthenticated remote network access to orchestrator portal.
22 September 2026	CVE-2026-93952	CWE-20: Improper Input Validation	10.0 (Critical)	Unauthenticated remote network access; fixed in Security Advisory 0183.
22 October 2026	CVE-2026-114625	CWE-89: SQL Injection	9.9 (Critical)	Authenticated network access with lowest role (Enterprise Read Only); Advisory 0199.

The operational progression reveals a shift in attack methodology. While July and September saw unauthenticated command injection vulnerabilities rated at the maximum 10.0 score, October's zero-day requires an authenticated session. However, in an enterprise SD-WAN ecosystem where thousands of branch staff, contractors, and managed service provider (MSP) operators hold credentials, a flaw requiring only the lowest read-only role provides negligible defensive barrier against determined adversaries.

UK regulatory context and resilience obligations

For UK organisations operating in critical infrastructure, healthcare, or financial services, an exploited zero-day in central SD-WAN management directly engages statutory resilience mandates.

The UK National Cyber Security Centre (NCSC) explicitly states in its WAN and Gateway Security Collection that management interfaces for wide area network controllers must never be exposed directly to untrusted networks or the public internet. NCSC guidance specifies that administrative planes require multi-factor authentication, dedicated management network segmentation, and strict ingress allowlists. Furthermore, under Cyber Essentials Requirements for Infrastructure v3.3, Requirement 4.2 mandates that administrative functions must be separated from general user access and that default access to administrative portals must be restricted.

Under the UK Network and Information Systems (NIS) Regulations and the Prudential Regulation Authority (PRA) Supervisory Statement SS1/21 on Operational Resilience, operators of essential services must demonstrate that the compromise of a third-party management appliance cannot propagate unchecked across corporate network segments. Deployers running on-premises VeloCloud Orchestrators must document their patch application and verify that lateral movement from the orchestrator host to connected enterprise endpoints has been actively investigated.

Defender checklist: ordered response for enterprise teams

The exposing question

When an enterprise wide area network relies on a central software-defined orchestrator to enforce routing policies and tenant boundaries across thousands of branches, does your incident response strategy treat the orchestrator as a hardened perimeter trust anchor, or as a single point of failure where a single read-only session grants an adversary keys to the entire corporate kingdom?

Key facts