VeloCloud Orchestrator CVE-2026-114625: Patch and Hunt

CVE-2026-114625 is a SQL injection in on-premises Arista VeloCloud Orchestrator (VCO) that lets any authenticated portal user gain operator privileges and act as the local “superuser operator”. The lowest built-in tenant role, Enterprise Read Only, is enough. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on October 23, 2026. Upgrade to VCO 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later, restrict the web interface to administrative networks until you can, and then check the orchestrator for signs that someone used it before you did.

It is also the third exploited VCO vulnerability in three months. If you patched in July or September and stopped there, you are still exposed.

Are you affected?

You are affected if you run VCO on-premises on one of these versions, as listed in Arista’s CVE record:

Arista says hosted VCO, including Dedicated, was affected and has already been patched. The record lists no 7.0 range for this CVE and marks unlisted versions as unaffected, but Arista’s September advisory did list 7.0 builds as affected by an earlier flaw. If you run 7.0, confirm your status with Arista rather than relying on the absence of a row. With the July flaw, Arista said it had not assessed end-of-support releases, so if you are on an older train, ask Arista’s Technical Assistance Center (TAC) about upgrade paths.

VCO is the management plane for VeloCloud SD-WAN. It holds configuration, device inventory and credentials for the Edges it manages, so treat it as a tier-0 system even if it doesn’t look like one in your asset inventory.

What the vulnerability does

Arista’s description in the CVE record: on an affected system, “any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user”. That includes functionality meant for internal use only and not meant to be reachable remotely. The record classifies it as CWE-89 (SQL injection).

The conditions, per the record’s configuration notes:

• VCO is exposed by default, and “there is no configuration that can prevent the exposure”.
• The attacker needs network access to the VCO web interface.
• The attacker needs a valid authenticated session on the VCO portal. The minimum role is Enterprise Read Only.

That last condition matters more than it first appears. In a multi-tenant VCO, a read-only user at one customer or one business unit could reach operator-level control over the whole orchestrator. Every tenant login, including service accounts, shared logins and accounts left behind by former staff or partners, is a possible starting point.

Arista scores it CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and CVSS 4.0 9.4. The PR:L (low privileges required) is the only thing keeping it off 10.0. The record says the issue was discovered externally. Arista published Security Advisory 0199 and the CVE record on October 22, 2026.

Exploitation status

The evidence of exploitation comes from CISA rather than from Arista’s CVE text:

• KEV: CISA added CVE-2026-114625 on October 23, 2026, with a due date of October 26, 2026 for US federal civilian agencies. The entry has the forensic triage flag set, so under BOD 26-04 agencies must also check for compromise, not just patch. Known ransomware use is listed as “Unknown”.
• SSVC: CISA’s Vulnrichment entry in the CVE record, timestamped October 22, rates Exploitation active, Automatable no and Technical Impact total. If you use the SSVC deployer model, “active” plus “total” puts an internet-facing VCO at the top of the queue even though the flaw needs a login.

Arista’s records for the July and September VCO flaws said explicitly that they were “known to be actively exploited”. The October record does not, and at the time of writing we found no public detail on who is exploiting this one or how. Treat attribution and scale as unknown.

Third exploited VCO flaw since July

CISA’s KEV catalog now lists three VeloCloud Orchestrator vulnerabilities, all added in 2026:

Each fix moved the floor. We checked a set of common builds against the affected ranges in all three CVE records:

That table was generated by comparing each build to the affected version ranges in the three CVE JSON records from the CVEProject/cvelistV5 repository. It reflects what the records say, not testing against a VCO. Arista’s September advisory did not list a fixed 6.1 or 7.0 build for CVE-2026-93952 when it was published, so for those trains check Arista’s current advisory before assuming you’re clear.

The practical point: an orchestrator that was patched once and then left alone has been inside at least one exploited vulnerability window for most of the last three months. That changes the hunting question from “was I hit last week?” to “has this box been clean since July?”

What to do now

1. Find every VCO you run. Include lab, DR and acquired-company instances. Record version, train and whether the web interface is reachable from the internet.
2. Restrict the web interface to trusted administrative networks now, before the upgrade window. This is Arista’s first interim control. It does not remove the risk from users who already have access.
3. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. If you are on 7.0 or an unsupported train, open a case with Arista TAC.
4. Preserve evidence first if anything below looks wrong. Arista’s September advisory asks for web access logs, application and system logs, database logs and file-system timestamps to be kept before remediation. An upgrade can overwrite exactly the files you need.
5. Cut back portal accounts. Remove dormant tenant users, rotate shared credentials, and check that partner and MSP accounts are still needed. This flaw turns every one of them into a path to operator rights.
6. Block outbound traffic from the VCO host that normal operation doesn’t need. Arista lists this in the October workarounds.

For the wider prioritization question, our guide to matching the KEV feed against a scanner export shows how to catch the next one automatically.

How to hunt

Arista’s October record lists the same detection areas as its earlier VCO advisories: access from known malicious IPs, unexpected outbound network activity from the VCO host, backdoor daemons and web shells, and unexpected administrator activity. It does not publish indicators specific to CVE-2026-114625.

Arista did publish concrete indicators with the September flaw, CVE-2026-93952 (Security Advisory 0183). Arista has not said they are linked to the October issue. Because most builds vulnerable today were also exposed to CVE-2026-93952, they are a sensible baseline:

A starting point on the VCO host, run as root. This is illustrative and was not tested against a VCO; adjust log paths to your build:

# Persistence files named in Arista advisory 0183
ls -la /usr/local/sbin/.vcnode.js /usr/local/sbin/vc-sysmond \
       /etc/systemd/system/vc-sysmon.service 2>/dev/null
md5sum /usr/local/sbin/vc-sysmond 2>/dev/null

# Header and source IPs from the same advisory in nginx logs
zgrep -il 'x-vc-opt' /var/log/nginx/*access* 2>/dev/null
zgrep -hE '142\.93\.149\.77|104\.248\.126\.159' /var/log/nginx/*access* 2>/dev/null | head

# Unexpected outbound connections from the orchestrator
ss -tnp state established

Beyond file indicators, Arista’s advisories point to behavior worth reviewing in the VCO’s own audit trail:

• operator-level actions taken by accounts that only hold tenant roles, or by the local superuser operator at times nobody on your team was working
• sensitive configuration changes or privileged maintenance actions with no matching change ticket
• database exports, new archive files, or unexpected access to device inventory, certificates and keys
• configuration pushed to Edges that you did not approve

If you find a compromise, Arista’s guidance from the earlier advisories applies: rotate credentials, validate the state of every managed Edge, and restore or replace the orchestrator from a trusted source. Patching a compromised VCO does not remove an attacker who is already there.

Limits of this article

We could not retrieve Arista’s Security Advisory 0199 page directly. The affected versions, conditions, workarounds and description above come from the CVE record Arista published as the CNA, which carries the advisory’s content. We have not tested any VCO build, and the hunting commands are a starting point, not a validated detection. There is no public technical write-up of the exploit at the time of writing.

Sources and verification

Vulnerability ManagementIncident ResponseSd-WanSql Injection