What Is an SD-WAN Orchestrator and What Can It Reach?

An SD-WAN orchestrator is the central management server for a software-defined wide area network. It stores the configuration, policies and credentials for every branch device in the network and pushes changes to them. Administrators log in to its web portal to manage links, routing and security for every site at once. Control of the orchestrator means control of the network, which is why attackers keep targeting products such as VeloCloud Orchestrator and Cisco Catalyst SD-WAN Manager.

What is an SD-WAN orchestrator?

An SD-WAN orchestrator is the server that defines and distributes the configuration for every edge device in a software-defined WAN. It is the management plane: it decides what the network should do, while the edges at each branch forward the actual traffic.

Vendors use different names. Arista calls it the VeloCloud Orchestrator (VCO). Cisco calls it Catalyst SD-WAN Manager, formerly vManage. The role is the same in each case: one portal, many sites.

The three layers of an SD-WAN

Most SD-WAN products split into three parts:

• Edges sit at each branch, data center or cloud region. They terminate the internet and MPLS links, build encrypted tunnels and apply traffic policy.
• Gateways or controllers help edges find each other, relay traffic to cloud services and distribute routes.
• The orchestrator holds the desired state for all of the above and the accounts of everyone who can change it.

In most designs, edges keep forwarding traffic if the orchestrator goes offline. They stop receiving new policy, and nobody can make changes until it returns. That split explains why an orchestrator outage is an inconvenience while an orchestrator compromise is an emergency.

What can an SD-WAN orchestrator reach?

An SD-WAN orchestrator can reach and reconfigure every edge device it manages, and it stores the data needed to do so. A compromise of the orchestrator can therefore change routing, security policy and access at every connected site.

In practice that includes:

• Device configurations, including firewall rules, VPN settings and segmentation policy for every site
• Enrollment and authentication material that ties edges to the orchestrator
• User accounts for the operators, partners and tenants who manage the network
• Logs and monitoring data that reveal the layout of the whole WAN

Arista's advisories for three exploited VCO flaws in 2026 all describe the impact the same way: an attacker may access privileged internal functionality and impact the VCO host, compromising the orchestrator and the data it manages. Its September advisory added that a compromised VCO may also expose the Edge devices it manages. The October VeloCloud Orchestrator zero-day went further: any logged-in user, including the lowest read-only tenant role, could become a superuser operator.

Tenants, operators and partners

Many orchestrators are multi-tenant. A service provider runs one instance and gives each customer an enterprise account with its own users. The roles typically form a ladder:

1. Operator accounts run the platform itself, across all customers.
2. Partner accounts manage a group of customers on behalf of a reseller or MSP.
3. Enterprise accounts manage one customer's network, from full administrator down to read-only.

The boundaries between those layers are what keep one customer's monitoring login from becoming everyone's administrator. A vertical privilege escalation bug collapses them. That is why CVE-2026-114625 carries a "scope changed" CVSS rating: the attack starts in one tenant and ends with control of the platform.

Why do attackers target the SD-WAN orchestrator?

Attackers target SD-WAN orchestrators because one compromise gives them configuration access to every site in the network. They also sit on infrastructure that endpoint security tools rarely cover, so an intruder can stay unnoticed for longer.

The orchestrator's web portal also has to be reachable by administrators, partners and sometimes the edges themselves. Arista states that the VCO web interface is exposed by default. Cisco's SD-WAN Manager had its own exploited authentication bypass this year, covered in our report on Cisco Catalyst SD-WAN Manager CVE-2026-76504.

How do you protect an SD-WAN orchestrator?

Protect an SD-WAN orchestrator by limiting who can reach its portal, keeping it on the vendor's fixed releases and treating every account on it as privileged. Watch its outbound traffic, because a management server has few legitimate reasons to start new connections.

Concrete steps:

• Restrict the portal to administrative networks or a jump host. Vendors recommend this in every recent advisory, and it turns many internet-exposed bugs into internal ones.
• Patch on the vendor's emergency schedule. For on-prem instances you own the patching; hosted instances are patched by the vendor.
• Prune accounts. Read-only users, partner logins and API integrations are all entry points. See how to audit read-only accounts on a management portal.
• Log centrally. Send web access, application and system logs off the box so an intruder cannot erase them.
• Limit outbound traffic to the ports and destinations the orchestrator actually needs.
• Plan for repeat incidents. A product that has needed several emergency patches in one year deserves its own playbook, as covered in why repeat zero-days in one product need a different plan.

Hosted or on-prem orchestrator?

Hosted orchestrators move patching to the vendor. Arista says its hosted and Dedicated VCO instances were already patched when each of its three 2026 VCO advisories went out. You still own the accounts, the role assignments and the review of tenant activity. On-prem orchestrators give you full control of the host and its logs, along with full responsibility for patching it within hours of an advisory.