How a Read-Only Account Could Give Hackers Control of Network Management

A read-only account shouldn't be able to take control of a network management system. But a critical vulnerability affecting certain on-premises versions of Arista's VeloCloud Orchestrator could allow an attacker to do exactly that.

On October 22, 2026, Arista disclosed CVE-2026-114625, a critical SQL injection vulnerability with a CVSS v3.1 score of 9.9.

Even users with the lowest Enterprise Read Only permissions could exploit this vulnerability to escalate their privileges and impersonate a superuser operator. Exploitation requires access to the Orchestrator web interface and a valid authenticated session.

Arista confirmed that the vulnerability is being actively exploited, and CISA added it to its Known Exploited Vulnerabilities catalog on October 23.

The concerning part isn't just the severity of the vulnerability. It's what an attacker could potentially control after exploiting it.

Why Compromising Network Management Is So Dangerous

VeloCloud Orchestrator is a centralized platform used to configure, monitor, and manage enterprise SD-WAN networks.

Rather than managing individual devices separately, administrators use it to control network configurations, policies, and connectivity across multiple locations.

That makes it a valuable target.

With superuser-level access, an attacker could interfere with network configurations, access sensitive information, or disrupt connectivity across the systems the orchestrator manages.

Arista has confirmed active exploitation but has not disclosed whether attackers carried out these specific actions.

What This Means for Infrastructure and Security Teams

While this vulnerability affects SD-WAN orchestration, the underlying security concern extends beyond a single platform.

Modern infrastructure relies on interconnected management systems, network devices, compute, and storage. When attackers gain privileged access to one of these systems, the potential impact depends on what it controls and how it connects to the rest of the environment.

For infrastructure and security teams, understanding these connections is essential to assessing how far a compromise could reach.

What Affected Organizations Should Do

Arista has released fixes for the affected VeloCloud Orchestrator versions:

• VCO 5.2: Update to 5.2.3.18 or later in the 5.2 release train.

• VCO 6.1: Update to 6.1.3.10 or later in the 6.1 release train.

• VCO 6.4: Update to 6.4.2.12 or later in the 6.4 release train.

Arista says its hosted deployments, including Dedicated instances, have already been patched. End-of-support versions have not been assessed.

Organizations running affected deployments should prioritize updating, restrict access to management interfaces, and review logs for suspicious activity. Arista also recommends monitoring for unexpected outbound connections and administrator activity.

The full remediation guidance and indicators of compromise are available in Arista's security advisory.

Beyond the Vulnerability

Patching the affected VeloCloud versions is the immediate priority, but the incident also highlights a broader concern.

Management platforms often have privileged access to critical infrastructure. When one is compromised, the potential impact depends on what it controls and how far that access extends.

For infrastructure and security teams, understanding those connections is just as important as identifying the vulnerabilities themselves.