Arista Reports Active Exploitation of VeloCloud Orchestrator Zero-Day
Arista disclosed that attackers are exploiting a zero-day SQL injection flaw in VeloCloud Orchestrator, which manages SD-WAN networks. A logged-in user, even with read-only customer access, could escalate to operator privileges. The advisory was issued on October 22.
Arista has reported that a previously unknown SQL injection vulnerability in VeloCloud Orchestrator is being used in real attacks. The software manages SD-WAN networks. The company's advisory, dated October 22, says an authenticated user with only read-only customer permissions could raise their access to operator level.
The notice concerns active exploitation, not just a theoretical flaw. Because the affected product is used to administer SD-WAN environments, the issue involves access control within a network-management tool.
The affected orchestrator sits in the management layer for SD-WAN networks, so exploitation could matter to organizations that rely on it to oversee connectivity. If lower-level accounts can be elevated, defenders may need to review permissions and activity logs. The immediate societal impact may be concentrated among network operators and their customers, though service disruptions or data exposure could ripple to dependent users.