Cybersecurity experts have raised alarms after hackers began exploiting a significant SQL injection vulnerability in the VeloCloud Orchestrator (VCO). This flaw enables authenticated users to acquire superuser access, escalating potential security threats.
Vulnerability Details and Impact
Arista Networks revealed this critical vulnerability on October 22, 2026, highlighting the risk of orchestrator and data compromise. The vulnerability, identified as CVE-2026-114625, has been actively exploited, urging immediate concern. With a CVSS v3.1 score of 9.9 and v4.0 score of 9.4, the flaw poses severe risks to affected systems.
Arista’s Security Advisory 0199 categorizes the issue as SQL injection, specifically CWE-89. Exploiting this flaw requires network access and a valid session, although not necessarily an administrative account. Even the lowest level of tenant access, Enterprise Read Only, is sufficient for exploitation.
Exploitation Mechanics and Consequences
Attackers leveraging this vulnerability can escalate their privileges to that of a local superuser, gaining access to sensitive internal functions remotely. This threatens the confidentiality, integrity, and availability of the orchestrator and its managed data. Notably, this is not an unauthenticated attack, but still allows significant unauthorized access.
The exposure of VCO by default, without any product configuration to mitigate it, compounds the issue. Arista has addressed the vulnerability in hosted deployments, but the onus remains on organizations to restrict network access and apply patches promptly. Previous exploits of VeloCloud Orchestrator involved different vulnerabilities, underscoring a pattern of security weaknesses.
Mitigation Measures and Recommendations
Arista advises that affected on-premises deployments, such as specific VCO 5.2.x, 6.1.x, and 6.4.x releases, be upgraded to patched versions. Operators should verify that their products require updates, as other systems, like VeloCloud Gateway, remain unaffected.
Security teams are urged to block IP addresses 74.82.197.86 and 38.54.50.151, identified as sources of attack attempts. Comprehensive examination of historical logs and network activities is crucial to identify any signs of breach.
Organizations should implement interim controls, such as restricting web access to trusted networks and reviewing for unusual activities. However, installing the fixed release should be prioritized as the definitive measure against this vulnerability.
Given the confirmed exploitation, it is essential for affected entities to treat patching as an urgent security measure rather than routine maintenance. Keeping defenses updated against emerging malware is also recommended to fortify security postures.
