CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability

The advisory says an attacker with a valid session can gain operator privileges and masquerade as the local "superuser operator" user. That opens functionality meant for internal use and not meant to be reachable remotely. The orchestrator manages SD-WAN edges and the data behind them, so compromise puts confidentiality, integrity and availability of the orchestrator and its host at risk. The CVSS 3.1 vector has a changed scope (S:C), which reflects reach beyond the vulnerable component.

The attacker needs network access to the VCO web interface and a login. The lowest role that works is Enterprise Read Only. VCO is exposed by default and no setting prevents it. Arista reports active exploitation and advises watching for backdoor daemons and web shells, which suggests attackers go on to plant persistence on the host.

Hosted and Dedicated VCO deployments were already patched by Arista. Only customers who run VCO on-prem need to act.

Affected VCO on-prem releases: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12. Arista did not assess end-of-support versions. The advisory documents no command; compare your installed VCO software release with this list. If your release is not in it, the advisory says you are not vulnerable.

Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later, matching your release train.

Until you patch, Arista advises restricting web interface access to trusted administrative networks, blocking or monitoring the known malicious IPs, watching outbound traffic from the VCO host and blocking unneeded outbound ports, and reviewing recent administrator activity for unexpected changes.

CISA's required action: apply mitigations per vendor instructions, follow BOD 26-04 and CISA's forensics triage requirements, or discontinue use of the product if mitigations are unavailable. The due date is 2026-10-26 and binds US federal agencies.

Check VCO web access logs for requests from 74.82.197.86 and 38.54.50.151. Look for unusual URL-like path components, encoded characters, references to local or internal services, and high request rates. Watch for backdoor daemons, web shells, unexpected outbound traffic from the host, and administrator changes you did not make. If you suspect compromise, preserve web access logs, backend application logs, system logs, database logs and file-system timestamps before you remediate, where you can.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.

Hosted, including Dedicated, versions of VCO were impacted and have already been patched.