Arista Warns Critical VeloCloud Flaw Lets Low‑Privilege Users Hijack Networks
A critical SQL injection bug in Arista’s VeloCloud SD‑WAN software, rated 9.9, is being actively exploited to let even read‑only users gain full operator control. For companies that route branch traffic through these devices, the flaw opens a direct path for attackers into core networks.
A newly disclosed security hole in Arista’s VeloCloud software is giving attackers a shortcut into corporate networks by turning low‑privilege accounts into full‑control operator logins.
The flaw, tracked as CVE‑2026‑114625, carries a severity score of 9.9 out of 10 under the widely used CVSS rating system—about as serious as software vulnerabilities get. It affects Arista’s VeloCloud SD‑WAN platform, a technology used by enterprises and service providers to steer traffic from branch offices and remote sites over the internet. Arista has confirmed that attackers are already exploiting the bug in the wild.
At its core, the vulnerability is an SQL injection weakness. That means an attacker who can send certain crafted requests to the system can trick it into running malicious database commands. In this case, security researchers and Arista’s own advisory say that even users with read‑only accounts—supposedly limited to viewing network status—can abuse the flaw to escalate their role to full operator privileges.
For organizations, that’s a dangerous escalation path. SD‑WAN controllers sit in the middle of critical traffic flows, deciding which applications go over which links and often tying into authentication systems. If an attacker can seize operator‑level access, they can rewrite routing policies, silently redirect or copy data, disable security checks, or use the device as a launchpad into deeper parts of the network.
Companies that rely on VeloCloud for connecting retail stores, factories, or regional offices are particularly exposed. A single compromised controller can affect dozens or hundreds of sites, turning what looks like a limited account breach into a company‑wide incident. In sectors like finance, healthcare and energy, where SD‑WAN is now standard, this kind of control can translate into access to sensitive records, operational technology or payment systems.
The fact that exploitation has already begun changes the calculus for defenders. This is no longer a theoretical vulnerability; it is a live doorway that criminal groups or state‑linked actors are probing. Attackers often move fast when a high‑impact bug becomes public, racing to compromise as many systems as possible before administrators can patch. For environments with weak segmentation, one foothold on a VeloCloud controller may be enough to roam laterally and plant ransomware or data‑stealing implants.
The episode underscores a larger shift in cyber risk. As enterprises push more of their networking intelligence into centralized SD‑WAN and cloud controllers, those systems become high‑value targets. A flaw there doesn’t just leak one user’s data; it warps the behavior of the entire network. Vendors are under pressure to lock down management interfaces, audit code paths that handle user input and give customers better tools to see when a supposedly harmless account starts acting like an administrator.
A simple way to remember the stakes is this: when your branch traffic depends on a central brain, any bug that lets an outsider rewrite that brain’s instructions is a potential company‑wide problem.
In the near term, the critical signals will be how quickly organizations apply Arista’s patches or mitigating controls, whether exploit code becomes widely available in public hacking toolkits, and if regulators or industry bodies start pressing vendors to meet stricter security baselines for SD‑WAN products. A wave of breaches traced back to CVE‑2026‑114625 would rapidly raise the cost of delay.
Sources
- OSINT