NexusSec.An SD-WAN orchestrator controls every branch and every link it manages. That makes it one of the most valuable systems on a multi-site network, and one of the most dangerous to leave exposed. This post reflects what was published up to 1 November 2026.
What happened
Arista published security advisory 0199 on 22 October 2026 for CVE-2026-114625, a SQL injection flaw in the on-premises VeloCloud Orchestrator, and said it is known to be exploited. Arista rates it 9.9 under CVSS v3.1 and 9.4 under CVSS v4.0. CISA added it to its Known Exploited Vulnerabilities catalogue on 23 October.
According to the advisory as reported, any authenticated user, down to the lowest Enterprise Read Only role, can gain operator privileges and pose as a local superuser operator. That opens internal-only functions that could compromise the orchestrator host and the data it manages. The on-premises orchestrator is vulnerable by default, and no configuration change removes the exposure.
Who is affected
- On-premises VeloCloud Orchestrator deployments.
- Hosted orchestrators, including dedicated ones, were also affected, but Arista had already patched them.
- VeloCloud Gateways and Edges are reported as not affected.
A pattern worth noticing
Reporting describes this as the third exploited VeloCloud Orchestrator flaw in about four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.
What to do
- Upgrade on-premises orchestrators to the fixed release for your software train listed in Arista's advisory 0199. Secondary reports give different build numbers, so take them from Arista. If you run an end-of-support version, contact Arista TAC.
- Restrict access to the orchestrator's web interface to management networks or a VPN.
- Review orchestrator accounts. Remove the ones nobody uses, and remember that a read-only account was enough for this flaw.
- Review recent operator activity and configuration pushed to edges for anything you did not expect.
- Enforce MFA for orchestrator logins where it is supported.
The lesson for any SD-WAN
Whatever platform you run, the management plane deserves the strongest protection on the network: not reachable from the internet, few accounts, MFA, logging and fast patching. See site-to-site VPN mistakes, SD-WAN vs MPLS and our SD-WAN implementation service.
