Arista has issued a security advisory for a critical vulnerability, CVE-2026-114625, found in their VeloCloud Orchestrator. Attackers are actively exploiting this flaw, which has a CVSS score of 9.9. The vulnerability allows users with a read-only account to gain full operator-level privileges. This is possible because a crafted SQL query can manipulate the backend's request data. Exploitation requires network access to the VCO web interface and a valid login credential. This is the third exploited VeloCloud Orchestrator vulnerability reported by Arista since July, but it's the first to require authentication. The impact is significant, as an operator account controls the entire SD-WAN fabric for all customers managed by a tenant. The flaw could also potentially compromise the VCO host itself. Specific fixed versions are available for release trains 5.2, 6.1, and 6.4, with hosted and dedicated orchestrators already patched. Customers on unsupported trains should contact Arista for upgrade options. Interim controls include restricting web interface access and monitoring for suspicious activity. Arista has identified two IP addresses used in the attacks and advises customers to block them and search logs for related activity.