Arista VeloCloud Orchestrator SQL Injection Exploited in the Wild

Summary

Arista says attackers are exploiting CVE-2026-114625, an SQL injection flaw that lets an authenticated VeloCloud Orchestrator user gain local superuser operator privileges. Fixed releases are available for affected branches.

Key points

Arista says CVE-2026-114625 is actively exploited; it has not identified the attackers, affected-organization count, or post-escalation activity.
The flaw affects supported on-premises VeloCloud Orchestrator releases earlier than 5.2.3.18, 6.1.3.10, and 6.4.2.12 in their respective branches.
An authenticated portal session with an Enterprise Read Only account is sufficient to gain local superuser operator privileges; network access to the VCO web interface is required, but no user interaction is needed.
Arista says Hosted and Dedicated VCO environments have been patched; VeloCloud Gateway and VeloCloud Edge are not affected. End-of-support releases were not assessed.
Arista observed attacks from 74.82.197.86 and 38.54.50.151; their absence from logs does not establish that a system is clean.
Arista recommends upgrading, restricting VCO web access to trusted administrative networks, auditing accounts and sessions, and reviewing logs and host evidence for possible compromise.

Article Details

Vulnerability Types: SQL injection
Severity: Critical; CVSS v3.1 9.9 and CVSS v4.0 9.4
Affected Versions: VeloCloud Orchestrator On-Prem 5.2 releases earlier than 5.2.3.18
VeloCloud Orchestrator On-Prem 6.1 releases earlier than 6.1.3.10
VeloCloud Orchestrator On-Prem 6.4 releases earlier than 6.4.2.12
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Restrict the VCO web interface to trusted administrative networks.

Indicators of compromise

Type	Indicator	Context
IPV4	`38[.]54[.]50[.]151`	Source IP observed by Arista in attacks exploiting CVE-2026-114625.
IPV4	`74[.]82[.]197[.]86`	Source IP observed by Arista in attacks exploiting CVE-2026-114625.