Skip to content
Hacker Posts

Arista patches exploited VeloCloud Orchestrator SQLi zero-day

CVE-2026-114625 (CVSS 9.9), a SQL injection in on-prem VeloCloud Orchestrator, is exploited in the wild. An authenticated tenant user reaches operator privileges. Fix: 5.2.3.18/6.1.3.10/6.4.2.12.

Published 3 min read
cvearistavelocloudzero-daysd-wan

Arista's Security Advisory 0199, published October 22, confirms CVE-2026-114625 — a SQL injection in on-premises VeloCloud Orchestrator (VCO) — is known to be actively exploited. Arista rates it 9.9 CVSS v3.1 (9.4 on v4.0) and detected the activity itself. If you run a self-hosted VCO reachable by any tenant user, patch today.

What the bug does

The advisory classifies it as CWE-89 SQL injection. An authenticated user with network access to the VCO web interface can inject SQL through the orchestrator. The practical payoff, per Arista: a low-privileged tenant user escalates to operator privileges, reaching functionality meant for internal use only. The minimum role needed is Enterprise Read Only — the lowest built-in tenant role — so any account that can log in is a potential launch point. No user interaction is required.

This is the first of Arista's recent VCO zero-days to require a login; the earlier two were unauthenticated.

Affected and fixed versions

On-prem VCO only. Hosted and Dedicated orchestrators were already patched by Arista.

  • 5.2.x before 5.2.3.18
  • 6.1.x before 6.1.3.10
  • 6.4.x before 6.4.2.12

Fixed releases are 5.2.3.18, 6.1.3.10, and 6.4.2.12. Arista did not assess end-of-support versions; if you run one, assume exposure. VeloCloud Gateway and VeloCloud Edge are not affected.

Exploitation status

The "exploited in the wild" claim is Arista's own, in Advisory 0199. Arista has not said when attacks began, which orchestrators were hit, or named an actor — treat any attribution as speculation. BleepingComputer and The Hacker News both report two attacker-associated IPs to block, defanged here as reported:

# Attacker IPs, per BleepingComputer's reporting
74.82.197[.]86
38.54.50[.]151

Arista did not publish file hashes or domains. Hunting guidance is generic: unusual URL-like path components and encoded characters in requests to the VCO web interface, references to internal services, high request rates, and any unexpected backdoor daemons or web shells.

Action checklist

  1. Upgrade now to 5.2.3.18, 6.1.3.10, or 6.4.2.12 on your branch. This is a same-day job for any internet-reachable on-prem VCO.
  2. Restrict the VCO web interface to a management network or VPN while you stage the upgrade. The flaw needs a valid session, so cutting off untrusted access shrinks the window.
  3. Audit tenant accounts. Any Enterprise Read Only or higher account is in scope. Disable stale logins and rotate credentials for shared or service accounts.
  4. Block the reported IPs above and hunt your VCO web logs for the request patterns listed, back to before the advisory date.
  5. Review operator-level activity for actions taken by accounts that should not hold operator privileges.

Context

This is the third VCO flaw Arista has reported as exploited since late July — after CVE-2026-16812 (a CVSS 10.0 unauthenticated command injection, added to CISA KEV on July 27) and CVE-2026-93952 in September. VeloCloud Orchestrator is becoming a reliable target: it is a central SD-WAN management plane, often internet-facing, sitting above a fabric that routes production traffic. Arista's switching side is on the same trajectory — we covered its exploited EOS tunnel-decap flaw, CVE-2026-7473, in June. If you operate VCO on-prem, assume the next exploited bug is weeks away and keep the management interface off the open internet.

Related stories