Arista VeloCloud On-Prem CVE-2026-114625: Actively Exploited SQL Injection Enables Operator Privilege Escalation

1. Basic Information

• Advisory: Arista Security Advisory 0199
• Publisher: Arista Networks
• Release Date: 2026-10-22
• Source: Arista Security Advisory 0199
• Related References: BleepingComputer: Arista patches VeloCloud zero-day
• Related Malware and Threat Groups: Unidentified
• Related CVE: CVE-2026-114625
• Affected Products: Arista VeloCloud Orchestrator On-Prem
• Severity: Critical
• Basis of Severity: Allows escalation from the lowest tenant role to VCO operator privileges, impacting the confidentiality, integrity, and availability of the orchestrator and administrative data. Active exploitation has been confirmed.

2. Quick Summary

A vulnerability in on-premises VeloCloud Orchestrator (VCO) allows authenticated low-privilege users to leverage SQL injection to reach internal functions and impersonate a local superuser operator user. Arista has confirmed active exploitation in the wild and published two attacker IP addresses.

3. Attack Flow

Reconstructed Attack and Exploitation Chain from Public Information

1. The attacker prepares a valid low-privilege VCO portal session (Enterprise Read Only or higher).
2. They send a crafted HTTP request to the web management interface, exploiting input validation flaws to trigger an SQL injection.
3. They reach internal-only functions that are normally restricted from remote access, gaining operator privileges and impersonating a local superuser operator user.
4. Once privilege escalation is achieved, it may impact the VCO host and management data (specific subsequent configuration changes or persistence mechanisms have not been publicly disclosed at this time).

The table summarizes the public information above. Defender signals are suggestions for investigation in your own environment (Inference). Undisclosed implementation details and follow-on behavior are left unspecified.

4. Attacker Position and Execution Location

• A remote attacker who has network reachability to the VCO web interface and possesses a valid lowest-privilege tenant session.

5. Victim and Administrator Perspective

Victims

• From a regular user perspective, the session may appear normal, while administrative privileges and settings may be modified without authorization.

Administrators and SOC

• Observed as anomalous URL paths in web access logs, encoded strings, suspicious references to internal services, sudden spikes in request rates, and unexpected administrative action history.

6. Success and Failure Conditions

Success Conditions

• Running an unpatched vulnerable release in branch 5.2.x, 6.1.x, or 6.4.x (End-of-life versions have not been evaluated and are not deemed unaffected).
• Reachability to the VCO web interface and possession of a valid session with Enterprise Read Only privileges or higher.

Failure Conditions and Mitigations

• Immediately update to version 5.2.3.18, 6.1.3.10, or 6.4.2.12 depending on the active branch, and consult Arista TAC for migration paths if running unsupported branches.
• Restrict management interface access exclusively to trusted management networks until updates are completed (blocking public IOCs or rotating credentials alone does not remediate the vulnerability itself).

7. Impact Upon Success

• Unauthorized acquisition of superuser operator privileges.
• Compromise of the confidentiality, integrity, and availability of the VCO host and data managed by VCO.
• Unauthorized configuration tampering, persistence (backdoor installation), and potential further compromise of the SD-WAN management plane.

8. Observable Logs

Inference: The following items are investigation candidates for your organization. Availability depends on products, permissions, settings, and log retention policies, and should be distinguished from observation records in source reports. Do not attribute an event to this incident or confirm successful compromise based on a single indicator alone.

Email

• No email-based attack methods specific to this incident have been publicly disclosed.

Proxy / SWG / DNS

• Check VCO web access logs for published attacker IPs (74.82.197.86, 38.54.50.151), anomalous URL paths, encoded characters, internal service references, and high-frequency requests in short intervals.

Endpoint / EDR

• Preserve backend, system, and database logs as well as file modification timestamps on the VCO host within supported capabilities, and investigate for configuration tampering or abnormal processes (EDR deployment is not a prerequisite).

Identity / IdP

• Correlate VCO tenant authentication sessions and assigned roles, operator action history, and account modification logs chronologically.

SaaS / Cloud

• Hosted and Dedicated VCO instances are reported as patched by the provider. Inspect management settings and API usage history for on-premises environments to the extent available.

Network

• Track external connections to the VCO web interface chronologically alongside subsequent unusual outbound communications and internal connections originating from the host.

9. Determining Attack Success

Confirmed in Public Information

Arista has confirmed active exploitation and published two attacker IP addresses. However, detailed success stages and the full scope of post-compromise activities in individual victim organizations remain undisclosed.

Criteria for Internal Determination

• Attack Attempt Observed (Success Unconfirmed): Matching public IOCs or receiving anomalous requests alone does not confirm that privilege escalation succeeded in your specific operating environment. Cross-reference authentication sessions and request contents thoroughly.
• Subsequent Compromise Confirmed: Refers to stages where facts such as unauthorized operator actions, role or configuration changes, or host file modifications are objectively substantiated (simple matches to public IOCs do not constitute this stage).

10. Investigation Playbook

• Trigger: Detection of vulnerable version usage, matching public IOCs, anomalous URL paths, or unexpected assignment of operator privileges.
• Initial Review: Check active versions, external exposure status, active sessions, assigned roles, web access logs, and administrator action history.
• Endpoint/Server Investigation: Preserve and analyze running processes, web shell artifacts, daemon settings, file timestamps, and backend logs on the VCO host.
• Authentication/Cloud Investigation: Review tenant accounts, session details, operator roles, credential change history, and API token usage.
• Subsequent Actions: Track SD-WAN configuration changes, internal service access, suspicious outbound traffic (egress), persistence configurations, and data access.
• Containment: Apply software patches, restrict management plane reachability, invalidate suspicious sessions, rotate credentials, and rebuild systems if necessary.
• Determination Categories: Clearly distinguish between contact, execution, authentication success, data access, and subsequent compromise stages without assuming success in the absence of objective evidence.

11. Defense and Detection Ideas

• Single Events: Immediately detect inbound requests from public IOCs, requests containing anomalous paths or encoded characters, and unauthorized privilege spoofing to superuser operator.
• Chronological Correlation: Perform correlation analysis across the flow from low-privilege login to anomalous requests, escalation to operator privileges, configuration changes, and host outbound communication.
• Threat Hunting: Conduct cross-search queries across historical VCO web, backend, database, and system logs for the two published IPs, anomalous paths, and internal service references.
• Log Limitations: Because Arista has not published complete signatures for exploit requests, relying solely on IOC matching is insufficient.
• Priority Mitigations: Immediately update to patched versions, restrict management interface reachability, strengthen session protection, enforce the principle of least privilege, and ensure long-term log retention.

12. Facts / Inference / Hypothesis

Facts

• Arista has confirmed that CVE-2026-114625 is being actively exploited in the wild.
• Exploitation is possible if an attacker has network reachability to the VCO web interface and a valid session with at least the built-in tenant role (Enterprise Read Only or higher).
• SQL injection allows attackers to obtain operator privileges, impersonate a local superuser operator user, and access internal functions that are normally restricted from remote access.
• Attacker IP addresses 74.82.197.86 and 38.54.50.151 have been observed.
• Versions prior to 5.2.3.18 in branch 5.2.x, prior to 6.1.3.10 in branch 6.1.x, and prior to 6.4.2.12 in branch 6.4.x are affected. Patches are available in respective versions, and Hosted/Dedicated VCO instances are already patched (end-of-life versions have not been evaluated).

Inference

• Compromised or low-privilege tenant accounts may serve as an initial foothold, potentially leading from management plane compromise to SD-WAN configuration alterations or access to internal secrets.

Hypothesis

No additional hypotheses. Unverified items are documented in Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

14. Unknowns and Further Investigation

• Specific threat actors, the number of compromised organizations, the initial credential acquisition vectors, and detailed post-compromise activities are not publicly disclosed at this time.

15. Impact on SOCs and Organizations

Administrators operating on-premises VCO instances should immediately verify running versions, apply patches, and review historical logs for public IOCs, anomalous URL paths, encoded strings, internal service references, and administrative modification histories.

16. Summary by Target Audience

• For SOCs: Correlate and monitor public IPs, anomalous URL paths, backend and database logs, administrator action history, outbound communications from the VCO host, and web shell artifacts.
• For Administrators: Immediately update VCO to patched versions for each branch, restrict management interface access to trusted networks, and check for suspicious sessions, accounts, and configuration changes.
• For Users: No direct user actions are required, but promptly follow any instructions from administrators regarding credential updates or related tasks.