Arista Patches Actively Exploited VeloCloud Orchestrator SQL Injection Flaw
Summary
Arista says attackers are exploiting CVE-2026-114625, a critical SQL injection flaw in VeloCloud Orchestrator that lets a logged-in user gain operator privileges. Fixes are available for on-premises releases; hosted and dedicated systems are patched.
Key points
- Arista reports active exploitation of CVE-2026-114625, rated 9.9 CVSS.
- Exploitation requires network access to the VCO web interface and a valid account; an Enterprise Read Only account is sufficient.
- The flaw can elevate an attacker to local superuser, potentially exposing, modifying, or disrupting the orchestrator and managed data.
- On-premises fixes are in VCO versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. Hosted and Dedicated orchestrators have already been patched.
- Arista says VeloCloud Gateway and Edge are not affected; releases not listed as vulnerable are also not affected.
- Arista recommends blocking two attack IPs and reviewing web access logs for suspicious requests. It advises preserving relevant logs and file-system timestamps if compromise is suspected.
- The advisory does not identify affected orchestrators or attacker actions, and does not clarify whether attackers could retain access to Edge devices after exploiting this flaw.
Article Details
- Vulnerability Types
- SQL injection
- Severity
- Critical (CVSS 9.9)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Block the two attack IP addresses identified by Arista.
- Review VCO web access logs for unusual URL-like path components, encoded characters, references to local or internal services, or high request rates.
- If compromise is suspected, preserve relevant web access, backend application, system, and database logs, along with file-system timestamps, before remediation where possible.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe flaw lets an attacker with a read-only customer account gain operator privileges and act as a local superuser.T1190 · Exploit Public-Facing ApplicationAttackers exploit a SQL injection flaw through the network-accessible VeloCloud Orchestrator web interface.
CVE
CVE-2026-114625The flaw is tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale. Orchestrators running the releases that fixed the VCO flaws exploited in July and September are still affected, because those releases are olderCVE-2026-16812has reported as exploited, and the first of the three that requires a login. Neither the July flaw (CVE-2026-16812) nor the September flaw (CVE-2026-93952) needed one.CVE-2026-93952of the three that requires a login. Neither the July flaw (CVE-2026-16812) nor the September flaw (CVE-2026-93952) needed one.
Vendors
Products
Arista VeloCloud OrchestratorAttackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.VeloCloud EdgeVeloCloud Gateway and VeloCloud Edge are not affected. The 7.0 release train is not on the list, and Arista says any release not on the list is not vulnerable.