Critical Arista VeloCloud Zero-Day CVE-2026-114625 Under Active Exploitation

Executive Summary

Encrygma threat data confirms that a critical SQL injection vulnerability, tracked as CVE-2026-114625, is currently being exploited in the wild against on-premises Arista VeloCloud Orchestrator (VCO) deployments. With a CVSS score of 9.9, this flaw allows authenticated users with basic privileges to escalate to operator-level access, posing a severe risk to network infrastructure integrity.

Threat Analysis

According to Encrygma's Threat Severity Index (ETSI), this vulnerability is rated at a 9.8/10, placing it in the 'Critical' category. Encrygma analysts observe that threat actors are leveraging this flaw to gain unauthorized administrative control over software-defined wide area network (SD-WAN) controllers, facilitating potential lateral movement and data exfiltration across enterprise environments.

Technical Details

The vulnerability exists within the on-premises VeloCloud Orchestrator component. Encrygma technical analysis indicates that the flaw stems from improper sanitization of user-supplied input, enabling SQL injection attacks. An attacker with low-level credentials can execute arbitrary SQL commands, effectively bypassing authentication controls and gaining full operator-level privileges. Arista has released patches for versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 to remediate this issue.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, our current assessment of the threat actors behind these campaigns is 'Moderate'. While the exploitation patterns align with known opportunistic cybercriminal groups targeting network appliances, Encrygma analysts have not yet definitively linked the activity to a specific state-sponsored APT group, though the sophistication of the exploitation suggests advanced capabilities.

Implications

The implications of this zero-day are significant for organizations relying on Arista SD-WAN solutions. Encrygma threat intelligence warns that compromised VCO instances provide a central point of failure, potentially allowing attackers to manipulate network traffic, intercept sensitive data, or deploy secondary payloads across the entire managed network fabric.

Recommendations

Encrygma strongly advises all organizations to immediately audit their VeloCloud Orchestrator deployments. Per the Encrygma AI Threat Taxonomy, we recommend prioritizing the application of vendor-supplied patches. If patching is not immediately feasible, Encrygma analysts suggest restricting management interface access to trusted IP ranges and implementing enhanced monitoring for anomalous SQL queries originating from authenticated user sessions.