Rodrigo De Paul’s 85th-minute strike decided the fourth-round tie in Madrid after Paco Alcacer had earlier cancelled out Alexandre Moreno Lopera’s opener for the hosts.
With 25 minutes to go Los Che were heading out to that solitary strike, before Alcacer sparked the salvage job in the 70th minute.
Ten-man Villarreal held out for victory by the same scoreline at Segunda B outfit Cadiz.
Gerard Moreno and Matias Nahuel sent the Primera Division side into an unassailable-looking 2-0 lead inside half an hour, but it was far from plain sailing after the break.
First Aitor Arregi pulled one back in the 47th minute, before Adrian Marin saw red shortly after, but the visitors clung on to avoid embarrassment.
David Moyes’ Real Sociedad will need another crack at their Segunda B opponents, Real Oviedo, after they played out a goalless draw at the Estadio Nuevo Carlos Tartiere.