Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations utilizing Arista VeloCloud SD-WAN
Incident: Active exploitation of a zero-day SQL injection vulnerability in the VeloCloud Orchestrator.
Impact: Full compromise of the SD-WAN management system and potential access to the underlying host.
Attacker: Unidentified threat actors
Analysis: The vulnerability (CVE-2026-114625) enables any authenticated user, even those with the lowest ‘Enterprise Read Only’ role, to escalate privileges to a local superuser. Because the VeloCloud Orchestrator (VCO) is exposed by default, this flaw provides a direct path for attackers to modify or disrupt critical network data. This is the third exploited vulnerability reported for the VCO in recent months, indicating a targeted interest in SD-WAN infrastructure.
Recommendations: Immediately upgrade VCO to versions 5.2.3.18, 6.1.3.10, or 6.4.2.12 depending on your release train.; Implement strict network access controls to limit exposure of the VCO web interface.; Review system and database logs for unauthorized privilege escalation or unexpected administrative changes.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source