AI analysis
Claude Opus · 6 Nov 2026, 10:19 CET
Arista VeloCloud Orchestrator on-prem flaw lets any user gain operator control, exploited
Exploited SQL injection in on-premises Arista VeloCloud Orchestrator 5.2, 6.1 and 6.4 lets any authenticated user gain superuser operator privileges. Follow Arista's advisory now, restrict access and investigate for compromise. Hosted and Dedicated instances are already patched.
In plain terms
VeloCloud Orchestrator (VCO) is Arista's central management system for VeloCloud SD-WAN, which is software that controls how an organisation's branch offices and sites connect over the network. The on-premises version of this orchestrator has a flaw that lets anyone with any valid login act as a built-in 'superuser operator', the most powerful internal account. It also exposes internal functions that were never meant to be reachable over the network.
The weakness is SQL injection, meaning the software can be tricked into running attacker-controlled database commands. CISA has confirmed that attackers are using this flaw. Organisations that run their own VCO should treat this as urgent. Customers on Arista's hosted or Dedicated VCO service were also affected, but the vendor says those instances have already been patched.