Arista alerts customers to active zero‑day SQL injection in VeloCloud orchestrator

Arista Networks issued a security advisory on October 22 warning that a critical zero‑day SQL injection flaw in its VeloCloud Orchestrator (VCO) is currently being exploited by threat actors.

The VCO serves as the central management platform for VeloCloud software‑defined wide area network (SD‑WAN) deployments, a technology adopted by many enterprises to connect branch offices and remote sites. The vulnerability permits anyone with valid login credentials to inject malicious SQL commands into the orchestrator's database, potentially granting unauthorized access to configuration data and administrative functions.

According to the advisory, the flaw was unknown to the public until the attacks were observed, and Arista has confirmed that evidence of exploitation in the wild exists. Attackers appear to be using the injection vector to elevate privileges within the management system, a step that could enable broader network compromise.

In response, Arista has released patches that address the SQL injection issue and is urging all VCO users to apply the updates without delay. The company also recommends disabling unnecessary remote access, rotating administrator passwords, and reviewing logs for suspicious activity as immediate mitigation steps.

Security experts note that an exploited vulnerability in a network‑wide management console poses a serious risk, as it can lead to data exfiltration, service disruption, or the insertion of malicious traffic across multiple branch locations. The incident underscores the importance of rapid patch management for critical infrastructure components.

VeloCloud, originally a stand‑alone SD‑WAN provider, was acquired by Arista in 2020 and has since become a core part of the vendor's networking portfolio. The platform’s popularity stems from its ability to simplify branch connectivity and centralize policy enforcement, making it a valuable target for adversaries seeking to infiltrate corporate networks.

The emergence of a zero‑day exploit against an SD‑WAN orchestrator reflects a broader trend of attackers focusing on the management layer of network services. Researchers have observed an uptick in attempts to compromise similar platforms, citing the high payoff of gaining control over distributed network environments.

Arista says it will continue monitoring the situation and will issue further guidance if additional threats are identified. Organizations are advised to audit their VCO deployments, ensure that all security patches are applied, and consider implementing network‑segmentation controls to limit the impact of any potential breach.

The episode serves as a reminder that even well‑established networking solutions can harbor critical vulnerabilities, and that proactive security practices remain essential to protecting modern, cloud‑centric network architectures.