Arista Networks disclosed CVE-2026-114625 on October 22, a CVSS 9.9 SQL injection vulnerability in the VeloCloud SD-WAN Edge management interface that allows unauthenticated remote code execution and is being actively exploited in the wild.
What happened
The Arista security advisory identifies an unparameterized SQL query in the VeloCloud SD-WAN Edge management API. An attacker who can reach the management interface can inject arbitrary SQL to achieve OS-level command execution on the underlying appliance. The vulnerability exists in SD-WAN Edge software versions prior to 5.6.1. Arista confirmed exploitation in the wild before the patch was widely deployed.
VeloCloud is Arista's acquired SD-WAN platform, widely deployed in enterprise branch networking and WAN optimization. The management interface is typically exposed on a dedicated management VLAN or, in SaaS-managed deployments, through the VMware-origin cloud orchestrator now under Arista's ownership.
Technical detail
- CVE: CVE-2026-114625. CVSS v3.1 score: 9.9 (Critical). Attack vector: Network. No authentication required.
- Vulnerable versions: VeloCloud SD-WAN Edge all releases prior to 5.6.1.
- Fixed version: VeloCloud SD-WAN Edge 5.6.1. No workaround available; upgrade is the only remediation.
- Active exploitation: Arista confirmed exploitation before patch availability. No ransomware group or threat actor has been publicly attributed at the time of disclosure.
Why this matters
SD-WAN edge appliances sit at the perimeter of enterprise branch networks and handle all traffic between branch offices and the WAN. A compromised SD-WAN Edge becomes a persistent network-layer pivot point: an attacker who controls the edge appliance can inspect and modify branch traffic, intercept VPN credentials, and pivot laterally into branch network segments without triggering standard endpoint detection tools.
CVSS 9.9 with no authentication required and active exploitation makes this an immediate patching priority. The management interface exposure is the critical factor: if your management VLAN is reachable from untrusted segments, or if your VeloCloud deployment uses the cloud orchestrator model, assess your exposure before treating this as a routine patch cycle.
What to do
- Upgrade to VeloCloud SD-WAN Edge 5.6.1 immediately. For cloud-managed deployments, check the Arista cloud orchestrator for automatic upgrade availability.
- Restrict management interface access: ensure the VeloCloud management plane is only reachable from dedicated management networks with strict source IP controls. Never expose it to the internet.
- Review SD-WAN Edge logs for unusual API calls, unexpected configuration changes, or outbound connections from the appliance to unknown IPs. Focus on management API endpoint logs from Oct 15 onward.
- If you cannot patch immediately, add WAF or reverse-proxy rules blocking SQL metacharacters in management API request parameters as a temporary control. This is not a substitute for patching.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization runs VeloCloud or other SD-WAN edge platforms and needs guidance on exposure assessment or patching prioritization.