CVE-2026-114625: Actively Exploited VeloCloud Orchestrator Flaw Grants Superuser Access
Arista has disclosed CVE-2026-114625, a critical SQL injection vulnerability in on-premises VeloCloud Orchestrator deployments. The flaw is being exploited in the wild and allows any authenticated portal user, including an Enterprise Read Only account, to gain local superuser operator privileges.
Organizations should upgrade immediately to the fixed release for their branch, restrict the VCO web interface to trusted networks, and examine logs for activity identified in Arista’s advisory.
What Is CVE-2026-114625?
CVE-2026-114625 is an SQL injection vulnerability in VeloCloud Orchestrator On-Prem, the management platform for VeloCloud SD-WAN environments. Arista assigned a CVSS v3.1 score of 9.9 and a CVSS v4.0 score of 9.4 and tracks the issue internally as BUG2043622.
A successful attack can elevate a valid portal session to the local superuser operator role and expose functionality intended only for internal use. Arista warns that exploitation may affect the confidentiality, integrity, and availability of the orchestrator and the data it manages.
Which Systems Are Affected?
The flaw affects supported on-premises VCO releases in three branches. Arista-hosted and Dedicated VCO services were also affected, but the company says those environments have already been patched.
| Release train | Affected releases | Fixed release |
|---|---|---|
| 5.2 | Earlier than 5.2.3.18 | 5.2.3.18 or later |
| 6.1 | Earlier than 6.1.3.10 | 6.1.3.10 or later |
| 6.4 | Earlier than 6.4.2.12 | 6.4.2.12 or later |
VeloCloud Gateway and VeloCloud Edge are not affected by this CVE. End-of-support releases were not assessed, so organizations running them should contact Arista TAC rather than assume they are safe.
Earlier VCO updates are not enough. CVE-2026-114625 is the third actively exploited VCO vulnerability Arista has disclosed since July, following CVE-2026-16812 and CVE-2026-93952. Releases that addressed those earlier flaws still fall below the new fixed thresholds. Teams should verify the running VCO version against this advisory instead of relying on the date of the last upgrade.
What Does an Attacker Need?
Exploitation requires network access to the VCO web interface and a valid authenticated session. The minimum role is Enterprise Read Only, the lowest built-in tenant role. No user interaction is required.
Unlike the actively exploited VCO vulnerabilities disclosed in July and September, CVE-2026-114625 requires an authenticated portal session. However, the privilege requirement remains low because an Enterprise Read Only account is sufficient to reach local superuser operator privileges.
This makes credential hygiene part of the response. A low-privilege account that would normally have limited administrative value can become a path to full operator control. Internet-exposed VCO portals, shared partner access, stale accounts, and compromised credentials therefore deserve immediate review.
Is the Vulnerability Being Exploited?
Yes. Arista says it detected the vulnerability and confirmed active exploitation. The company has not publicly identified the attackers, the number of affected organizations, or the actions taken after privilege escalation.
Arista observed attacks from 74.82.197.86 and 38.54.50.151. These addresses are useful hunt leads, but their absence does not establish that a system is clean because infrastructure can change.
What Should Defenders Look For?
Arista recommends reviewing VCO web access logs and preserving evidence before remediation when compromise is suspected. Investigate:
- Requests with unusual URL-like path components or encoded characters
- References to local or internal services in web requests
- Unexpectedly high request rates or access from the two observed source IPs
- Unexplained administrator changes, outbound connections, backdoor daemons, or webshells
Preserve web access, backend application, system, database, and relevant file-system timestamp data where operationally feasible. Patching closes the vulnerability but does not determine whether an attacker already obtained operator access.
What Should Defenders Do Now?
- Upgrade immediately. Move to VCO 5.2.3.18, 6.1.3.10, or 6.4.2.12, or a later release within the same branch.
- Reduce reachability. Limit the VCO web interface to trusted administrative networks. There is no VCO configuration that removes the underlying exposure.
- Review authenticated access. Audit Enterprise Read Only, partner, customer, and administrative accounts; disable stale access and investigate unusual sessions.
- Contain suspected compromise. Block the observed IPs, restrict unnecessary outbound ports, preserve evidence, and contact Arista TAC for response or unsupported-release guidance.
- Validate hosted environments. Arista says Hosted and Dedicated VCO instances are patched, but customers should still confirm status through their normal service channel.
Why This Flaw Deserves Priority
The important risk is not SQL injection in isolation; it is the change in trust level that follows. A tenant account with the lowest built-in role can cross into operator-level control of a shared SD-WAN management plane. That creates a wider potential blast radius than an ordinary application account compromise.
The disclosure also shows why patch programs should track fixed versions, not only CVE closure. A system can be patched for a recent VCO zero-day and still remain vulnerable to the next one because the corrected build threshold has moved again.
How SOCRadar Can Help
Actively exploited vulnerabilities like CVE-2026-114625 require teams to understand both whether affected assets are exposed and whether credentials that could enable exploitation have been compromised.
SOCRadar’s Vulnerability Intelligence helps security teams track actively exploited vulnerabilities, affected products, and remediation information, while Attack Surface Management can help identify internet-facing VeloCloud Orchestrator instances and other exposed assets that require immediate attention. Identity & Access Intelligence adds another layer by helping organizations identify exposed or compromised credentials that could provide attackers with the authenticated access required to exploit CVE-2026-114625.
Together, these capabilities can help defenders prioritize vulnerable and exposed systems rather than treating every affected asset with the same level of urgency.
Conclusion
CVE-2026-114625 is a critical, actively exploited VeloCloud Orchestrator vulnerability with a low privilege requirement and high potential impact. On-premises operators should verify their exact release, deploy the fixed build, reduce portal exposure, and review both authentication activity and host-level evidence for signs of compromise.
