Topic starter
11/11/2026 6:03 pm
TL;DR: VeloCloud Orchestrator flaws let attackers move from web access into privileged internal functions, according to runZero research. SD-WAN management planes need tighter network restriction, because control-plane compromise can expose both orchestration logic and the data it manages.
Editorial analysis by NHI Mgmt Group, based on content published by runZero: “How to find Arista VeloCloud Orchestrator appliances on your network”.
By the numbers:
- CVE-2026-114625 was rated critical with a CVSS score of 9.9.
- CVE-2026-93952 was rated critical with a CVSS score of 9.5.
Key questions
Q: Why do management planes become high-value attack targets?
A: Management planes hold the controls for configuration, policy and remote administration, so compromising them can give an attacker broad control over many systems at once.
Q: What should teams do first when a network management interface is exposed?
A: Place the interface behind trusted administrative networks, remove public exposure, and require strong authentication before any further hardening.
Q: How do SQL injection flaws turn authenticated access into admin control?
A: SQL injection flaws let an attacker alter database queries so an authenticated session can read or change records beyond its intended scope, including privilege tables and admin flags.
Practitioner guidance
- Restrict orchestrator web access to administrative networks Place the VeloCloud Orchestrator interface behind tightly scoped management network controls and remove general enterprise reachability where possible.
- Segment certificate-based edge-to-orchestrator paths Keep certificate-authenticated connectivity limited to the minimum set of systems needed for operations, and do not let that trust path imply unrestricted application access.
- Prioritise emergency patching for affected release trains Move the affected 5.2.x, 6.1.x, 6.4.x, and 7.0.x branches to fixed builds or isolate them until upgrade is complete.
Bottom line: The central problem is a privilege boundary failure in a network orchestration plane, where web access can become administrative control.
Glossary terms: VeloCloud Orchestrator, SQL Injection, Certificate-based authentication, Privilege Escalation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
These flaws show that orchestrator trust was the real control gap. The issue is not simply weak filtering or a bad query. The control failure is that a management plane capable of administering the enterprise network accepted request paths that could be turned into operator-equivalent actions. In practice, this is a privilege-boundary failure in the control plane itself, not just an application bug.
A question worth separating out:
Q: How does certificate-based authentication still leave application risk?
A: Certificate-based authentication proves possession of a private key, but it does not remove application risk from weak authorisation, insecure session handling or flawed request validation. A valid certificate can still be abused if the application maps it to excessive privileges, trusts client-supplied data, or fails to enforce server-side access checks on each action.
👉 Read our full editorial: VeloCloud Orchestrator bugs let attackers reach privileged functions