Why an SD-WAN Orchestrator Is a Crown-Jewel Target: Lessons from CVE-2026-114625

Arista reported CVE-2026-114625, the third VeloCloud Orchestrator vulnerability exploited since July 2026. This SQL injection flaw, rated 9.9 on CVSS 3.1 and classified as CWE-89, follows previous exploits CVE-2026-16812 and CVE-2026-93952. As the system managing VeloCloud SD-WAN fabric, the Orchestrator controls tenant accounts, device inventory, and network topology. Because it manages how the network behaves, operator-level access to this component is disproportionately valuable, making it a crown-jewel target for attackers seeking network control.