Arista VeloCloud Orchestrator: SQL injection with privilege escalation

Summary

VeloCloud Orchestrator (VCO) on-prem contains an SQL injection flaw (CWE-89). An authenticated user with any valid portal login, even the lowest built-in role (Enterprise Read Only), can gain operator privileges and impersonate the internal "superuser operator" account. This gives access to functions intended only for internal use, which can compromise the orchestrator host and the data it manages. Hosted and Dedicated VCO instances are already patched, and Arista and CISA report active exploitation.

Affected

• On-prem VCO 5.2.0 to before 5.2.3.18
• On-prem VCO 6.1.0 to before 6.1.3.10
• On-prem VCO 6.4.0 to before 6.4.2.12
• Hosted and Dedicated VCO: already patched by the vendor
• Not affected per Arista: VeloCloud Gateway and VeloCloud Edge

Fixed in

• VCO 5.2.3.18 or later (5.2 train)
• VCO 6.1.3.10 or later (6.1 train)
• VCO 6.4.2.12 or later (6.4 train)
• Earlier patches for other VCO flaws do not fix this CVE.

Workaround

No configuration change prevents the exposure, because VCO is exposed by default. Until the fixed release is deployed, apply the defense-in-depth controls from Arista's advisory:

• Restrict access to the VCO web interface to trusted administrative networks.
• Monitor VCO for access from known malicious source IPs.
• Monitor for unexpected outbound network activity from the VCO host.
• Block outbound ports that are not needed.
• Monitor for backdoor daemons and webshells.
• Review recent administrator activity for unexpected changes.

Exploitation

• Arista reports that the flaw is known to be actively exploited.
• CISA added CVE-2026-114625 to the KEV catalog on 2026-10-23 with a federal remediation deadline of 2026-10-26.
• CISA SSVC: exploitation active, not automatable, total technical impact.
• A third-party index (as of 26 Oct 2026) found no public exploit code in Metasploit or Exploit-DB. This is not a confirmed absence.
• Unknown: start of exploitation, which orchestrators were hit, and what attackers did afterwards.

Our recommendation

• If you run on-prem VCO, treat this as urgent and upgrade to the fixed release for your train now.
• Verify the running build against Arista advisory 0199 before and after the upgrade.
• Restrict and audit access to the VCO web interface, including read-only accounts, and remove unused accounts.
• Review VCO and host logs for unexpected administrator actions, new accounts and outbound connections. If the VCO was exposed, check for signs of compromise.
• If you use Hosted or Dedicated VCO, no action is required on your side.
• If you have no VCO, no action is needed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  definitiveref/CVE-2026-114625-Proof-Of-Concept

Research sources

• Arista Security Advisory 0199 www.arista.com
• CISA Known Exploited Vulnerabilities Catalog entry www.cisa.gov
• CISA KEV alert (23 Oct 2026) www.cisa.gov
• The Hacker News: CISA flags two actively exploited flaws thehackernews.com
• Security Affairs: CISA adds Arista VeloCloud Orchestrator flaw to KEV securityaffairs.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:26.