Arista VeloCloud Orchestrator Zero-Day SQL Injection Actively Exploited

Arista Networks has issued an advisory regarding a critical zero-day SQL injection vulnerability affecting the VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks. According to the advisory published on October 22, 2026, the flaw allows anyone who can log in to the orchestrator, even with a read-only customer account, to gain operator privileges—the highest level of control over the system.

The vulnerability is a SQL injection flaw that enables privilege escalation. Attackers who gain initial access with low-privilege credentials can exploit the injection to elevate their access level to operator status. This escalation could allow full compromise of the SD-WAN management console, potentially leading to configuration changes, data exfiltration, or service disruption across the affected network.

Arista has confirmed that the vulnerability is being actively exploited in the wild. The company has released security updates addressing the flaw. Customers are strongly advised to apply the latest firmware or software versions for VCO immediately to mitigate the risk.

The advisory notes that the exploitation allows login with read-only credentials to escalate to operator privileges via SQL injection, though specific technical details of the injection vector remain limited in the public summary.