> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Arista VeloCloud Orchestrator SQL injection CVE-2026-114625 added to CISA KEV - URL: https://f4n6.co.uk/security-feed/arista-velocloud-orchestrator-sql-injection-cve-2026-114625-added-to-cisa-kev/ - Published: 2026-10-23T18:15:07.000Z - Updated: 2026-10-23T18:15:07.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-114625 ## 1\. Executive summary Arista has patched an actively exploited SQL injection in on-premises VeloCloud Orchestrator (VCO), tracked as CVE-2026-114625 and rated CVSS 9.4 CRITICAL (CWE-89) in NVD. The flaw lets any authenticated user with the lowest built-in tenant role escalate to operator privileges and masquerade as a local "superuser operator", reaching internal-only functionality that is not meant to be remotely accessible. Arista states the issue is known to be actively exploited and that no configuration removes the exposure; all VCO releases before 5.2.3.18, 6.1.3.10 and 6.4.2.12 are affected. CVE-2026-114625 is not in CISA KEV and EPSS sits at 1%, but it is the third exploited VCO zero-day in four months, after CVE-2026-16812 (July) and CVE-2026-93952 (September), both of which are in KEV. EMEA financial services running on-prem VCO to manage SD-WAN across branches, datacentres and cloud should treat the orchestrator as a Tier 0 asset: compromise gives an attacker control of the Edge estate, not just the management host. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | VCO is an ICT third-party component from Arista that manages the SD-WAN estate; the fix is a vendor release and Arista states no configuration removes the exposure | Third-party risk management must capture the vendor patch dependency and the residual exposure window for on-prem deployments, and the contractual position with Arista for patch SLAs and notification | | DORA Art. 30 | Remediation depends entirely on Arista shipping fixed releases (5.2.3.18, 6.1.3.10, 6.4.2.12) and on the client applying them | Key contractual provisions should cover patch availability, notification of actively exploited defects, and support obligations during the exposure window | | NIS2 Art. 21(2)(d) | The exploited component sits in the supply chain (Arista VCO) and the vulnerability is in a third-party product the entity depends on | Supply chain security measures must include monitoring vendor advisories for VCO and a tested process for emergency patching of network management infrastructure | ## 3\. Technical analysis & attack chain CVE-2026-114625 is a SQL injection in the VCO web interface. Arista's advisory describes the outcome as privilege escalation rather than pre-auth code execution: an attacker who already holds a valid authenticated session, at the lowest built-in tenant role, can gain operator privileges and impersonate a local "superuser operator" account. That reaches functionality intended for internal use only and not intended to be remotely accessible. The CVSS vector is not published in the sources, so the exact preconditions (network position, session handling) cannot be confirmed beyond Arista's statement that access to the VCO web interface and a valid authenticated session are required. Confirmed attack chain, from Arista's advisory as reported: 1. The attacker obtains a valid authenticated session on the VCO web interface at the lowest built-in tenant role. How that session is obtained is not stated in the sources. 2. The attacker sends requests to the VCO web interface that exploit the SQL injection, manipulating backend database queries. 3. The injection allows the attacker to reach privileged internal functionality and escalate to operator privileges, masquerading as a local "superuser operator". 4. With operator privileges, the attacker can act on the VCO host and the data it manages, affecting confidentiality, integrity and availability. The sources do not describe the specific injectable parameter, the backend database engine, or the exact request format. Arista's detection guidance points at the observable shape of exploitation: high request rates, requests with unusual URL-like path components, encoded characters, and references to local or internal services in VCO web access logs. Exposure. Arista states VCO deployments are exposed by default and that no configuration can prevent the exposure. Only on-premises deployments are affected; Arista's hosted and dedicated VCO service was patched before the advisory. Affected releases are all versions before 5.2.3.18, 6.1.3.10 and 6.4.2.12. Observed source addresses. Arista published two IP addresses from which attacks have been observed: 74.82.197.86 and 38.54.50.151\. These are single-sourced to Arista via SecurityWeek; verify before enforcing blocks, and treat them as historical rather than exhaustive. Context: three exploited VCO zero-days in four months. CVE-2026-16812 (OS command injection, CVSS 10.0, unauthenticated, KEV due date 2026-07-30) was patched in July with fixes in 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1\. CVE-2026-93952 (improper input validation, KEV due date 2026-09-25) was patched in September and affected orchestrators configured to authenticate Edges with certificates. CVE-2026-114625 is the third. An adversary who compromised a VCO through either earlier flaw and established persistence would retain that access across a patch of CVE-2026-114625 alone, which is why Arista's guidance includes hunting for backdoor daemons and webshells and preserving logs before remediation. Discrepancy note: SecurityWeek reports CVE-2026-114625 at CVSS 9.9; NVD records 9.4 CRITICAL. This advisory uses 9.4\. The source also describes the flaw as requiring authentication, which is consistent with the CWE-89 classification; no conflicting CWE is asserted in the sources. Attribution. No actor is named in any source, and no MITRE ATT&CK profile is associated with this activity. Attribution is unconfirmed. ## 4\. Mitigation & containment P1, within 24 hours: - Inventory every on-prem VCO instance and its version. Any release below 5.2.3.18, 6.1.3.10 or 6.4.2.12 is in scope. Hosted and dedicated VCO service customers are already patched by Arista. - Restrict access to the VCO web interface to trusted management networks and jump hosts. Arista states no configuration removes the default exposure, so network restriction is containment, not a fix. - Block 74.82.197.86 and 38.54.50.151 at the perimeter and in egress filtering, and search VCO web access logs for both. Single-sourced to Arista; verify before permanent enforcement. - Search VCO web access logs for high request rates, unusual URL-like path components, encoded characters, and references to local or internal services. - Preserve VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediation, where operationally feasible, per Arista's guidance. - Review recent admin activity for operator-privilege changes and any use of the "superuser operator" account that does not match change records. P2, within 72 hours: - Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12, or later, following Arista's instructions. This is the only remediation Arista recommends. - Hunt for backdoor daemons and webshells on VCO hosts, and monitor outbound ports for unexpected connections from the orchestrator. - Rotate credentials and sessions for VCO operator and superuser accounts, and for any tenant accounts that could have been used as the entry session. P3, within 7 days: - Extend the review to VeloCloud Edge devices. Arista's advisory on the earlier CVE-2026-16812 notes that compromise of the VCO platform may give attackers access to the Edge devices; the same trust relationship applies here. - Confirm that VCO patch status is tracked in the vulnerability management programme with the same priority as KEV-listed items, given the pattern of three exploited VCO flaws in four months. ## 5\. Indicators of compromise | type | value | confidence | source | | ---- | ---------------- | -------------------------------- | --------------------------- | | ipv4 | 74.82.197\[.\]86 | medium, single-sourced to Arista | SecurityWeek, citing Arista | | ipv4 | 38.54.50\[.\]151 | medium, single-sourced to Arista | SecurityWeek, citing Arista | ```iocs ipv4 74.82.197[.]86 ipv4 38.54.50[.]151 ``` Behavioural indicators | behaviour | where to observe | confidence | | --------------------------------------------------------------------------------------------------------- | ------------------------------------- | ----------------------------------------------------- | | High request rates against the VCO web interface | VCO web access logs | medium, Arista guidance | | Requests with unusual URL-like path components | VCO web access logs | medium, Arista guidance | | Requests containing encoded characters | VCO web access logs | medium, Arista guidance | | Requests referencing local or internal services | VCO web access logs | medium, Arista guidance | | Operator-privilege escalation or use of a "superuser operator" identity by a low-privilege tenant account | VCO application and audit logs | medium, derived from Arista's description of the flaw | | Backdoor daemons or webshells on the VCO host | VCO host file system and process list | medium, Arista guidance | ## 6\. Detection No file hashes, filenames, mutexes or command-line artefacts are given in the sources, so a YARA rule would have nothing genuine to match on. Detection rests on the log behaviours Arista describes. The Sigma rule below targets VCO web access logs; field names are placeholders and must be mapped to the client's log schema before deployment. ```yaml title: VeloCloud Orchestrator SQL Injection Exploitation Attempt id: 7f3c2a91-4d8e-4b6a-9c1e-2a5f8d0b3e47 status: experimental description: Detects requests to the VCO web interface matching Arista's exploitation guidance for CVE-2026-114625, including encoded characters, URL-like path components and references to internal services. author: Adverse Trace date: 2026-10-23 references: - https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/ logsource: category: webserver detection: selection_path: cs-uri-stem|contains: - 'http://' - 'https://' - 'file://' - 'localhost' - '127.0.0.1' selection_encoding: cs-uri-query|contains: - '%27' - '%22' - '%3D' - '%20' - 'union' - 'select' condition: selection_path or selection_encoding fields: - c-ip - cs-uri-stem - cs-uri-query - sc-status falsepositives: - Legitimate administrative tooling that passes URLs or encoded values in query strings level: high ``` Tune the encoding selection against normal VCO traffic before enabling alerting; the strings are generic SQL injection markers and will fire on benign administrative activity if left unbaselined. ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-114625](https://nvd.nist.gov/vuln/detail/CVE-2026-114625?ref=f4n6.co.uk) | 9.4 Critical | — | 1% | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged int… | ## 7\. Sources - NVD, CVE-2026-114625 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-114625, published 2026-10-22. - SecurityWeek, "Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months", https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/, 2026. - NVD, CISA KEV entry for CVE-2026-93952, https://nvd.nist.gov/vuln/detail/CVE-2026-93952. - NVD, CISA KEV entry for CVE-2026-16812, https://nvd.nist.gov/vuln/detail/CVE-2026-16812. - The Hacker News, "New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups", https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html, September 2026. - The Register, "Arista patches actively exploited VeloCloud bug as CISA puts admins on the clock", https://www.theregister.com/security/2026/07/28/arista-patches-actively-exploited-velocloud-bug-as-cisa-puts-admins-on-the-clock/5279414, 2026-07-28. - The Hacker News, "Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw", https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html, July 2026. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-114625 at CVSS 9.4 CRITICAL (CWE-89), not in CISA KEV, EPSS 1%, with active exploitation confirmed by Arista and no configuration that removes the exposure. The EPSS score understates the operational risk here: the flaw is authenticated, but the entry bar is the lowest tenant role, and the orchestrator controls the SD-WAN Edge estate, so a successful escalation reaches beyond the management host. The two attacker IP addresses and the exploitation detail are single-sourced to Arista via SecurityWeek; verify before enforcing blocks. Attribution is unconfirmed and no actor is named. Clients running on-prem VCO should patch to 5.2.3.18, 6.1.3.10 or 6.4.2.12 within 24 hours where change control allows, and restrict the web interface to management networks in the interim. Adverse Trace will track Arista advisories for further VCO flaws and update this advisory if new exploitation detail or indicators are published. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-114625?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*