As reported by BleepingComputer, Arista Networks has disclosed and patched CVE-2026-114625, a critical-severity SQL injection vulnerability in VeloCloud Orchestrator (VCO) On-Prem that is being actively exploited in the wild. This marks Arista's fourth actively exploited zero-day disclosed in 2026 alone — a pattern that warrants serious strategic attention from network security teams.
Vulnerability Profile
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-114625 |
| Severity | Critical |
| Type | Authenticated SQL Injection / Privilege Escalation |
| Complexity | Low (no user interaction required) |
| Affected Product | VeloCloud Orchestrator (VCO) On-Prem |
| Patched Versions | 5.2.3.18+, 6.1.3.10+, 6.4.2.12+ (hosted VCO already patched) |
| Active Exploitation | Yes — observed from 74[.]82.197.86 and 38[.]54.50.151 |
| Prerequisites | Valid authenticated session with basic privileges + VCO web interface access |
Why This Matters Beyond the CVE
The most alarming aspect of this disclosure isn't the SQL injection itself — it's the targeting pattern. Four actively exploited zero-days against the same vendor in a single year, three of them hitting on-premises VCO and EOS infrastructure, suggests a sustained and deliberate campaign against Arista's management plane. SD-WAN orchestrators are high-value targets: they hold credentials for edge devices across an entire WAN estate, making a single compromise functionally equivalent to compromising every managed site simultaneously.
The attack chain here is particularly insidious. Any authenticated user — even one with the most basic read-only role — can escalate to superuser operator privileges and access internal-only functionality. In environments where VCO is exposed to partner portals, multi-tenant configurations, or delegated administration models, a low-privilege foothold is trivially obtainable. The SQL injection then becomes the bridge from observer to full orchestrator takeover.
Who Is Most at Risk
Detection and Hunting Guidance
Arista's advisory provides specific IOCs, but defenders should go further. The SQL injection vector likely manifests in HTTP request parameters with anomalous content. Hunt for:
- Requests containing encoded characters, UNION SELECT patterns, or comment syntax (–, /*, */) in URL paths and POST bodies
- References to internal services or localhost in request parameters — a hallmark of SSRF-style pivoting post-escalation
- Unexpected superuser operator session creation events in backend application logs
- Database queries originating from the VCO application context that reference system tables or modify privilege tables
- Any successful authentication followed rapidly by privileged API calls from the same session token
The goal isn't just to detect this CVE — it's to detect the post-exploitation behavior that follows. An attacker with superuser operator access can push malicious configurations to edge devices, exfiltrate topology data, and establish persistence through the orchestrator's own management channels.
Shield53 Recommendations: Immediate Actions
- Patch now. Upgrade on-prem VCO to 5.2.3.18+, 6.1.3.10+, or 6.4.2.12+ depending on your branch. Do not delay for change windows — this is actively exploited.
- Network-segment the VCO interface. Restrict web access strictly to administrative jump networks. Remove any internet-facing exposure immediately. If remote access is required, force it through a VPN or zero-trust access proxy.
- Block known IOCs. Add 74[.]82.197.86 and 38[.]54.50.151 to firewall, WAF, and EDR block lists. Monitor for any historical connections to these IPs over the past 90 days.
- Audit authentication and sessions. Review all VCO user accounts, especially low-privilege ones created recently. Rotate credentials for all VCO administrators and service accounts. Check for session tokens with anomalous privilege levels.
- Preserve forensic evidence. If compromise is suspected, capture VCO web access logs, backend application logs, database logs, system logs, and filesystem timestamps before remediation. Contact Arista TAC for compromise assessment support.
- Assess blast radius. If VCO was compromised, assume all managed edge devices may be affected. Review edge device configurations for unauthorized changes, new tunnel endpoints, or modified routing policies pushed from the orchestrator.
For organizations running Arista infrastructure broadly, this should trigger a strategic review of management plane security. Four zero-days in a year is not bad luck — it's a targeting profile. Harden the management plane as if adversaries have already mapped it, because evidence suggests they have.
