Skip to content
Threat Feed
Subscribe
critical threat

Arista VeloCloud Orchestrator: SQL Injection Privilege Escalation (CVE-2026-114625)

Arista VeloCloud Orchestrator (VCO) is under active exploitation by attackers using a critical SQL injection vulnerability (CVE-2026-114625) to escalate from low-privilege tenant accounts to superuser operator status.

CVE search metadata

CVE search record: CVE-2026-114625. Severity: critical. CVSS: 9.9. KEV: no. Product: VeloCloud Orchestrator (< 5.2.3.18, 6.1.3.10, 6.4.2.12), VeloCloud Orchestrator (< 5.2.3.18, < 6.1.3.10, < 6.4.2.12). Brief: Arista VeloCloud Orchestrator: SQL Injection Privilege Escalation (CVE-2026-114625). Brief link: https://feed.craftedsignal.io/briefs/2026-10-velocloud-orchestrator-sqli/

Triage facts

Revision 2
Applicability
VeloCloud Orchestrator (< 5.2.3.18, 6.1.3.10, 6.4.2.12), VeloCloud Orchestrator (< 5.2.3.18, < 6.1.3.10, < 6.4.2.12)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
4 public sources
Freshness
Revision 2Oct 23, 11:27 UTC
Detection
1 rule · 2 IOCs
Vulnerabilities
1 CVE
Source quality
B1Almost certain
Revision history 1 entry · Revision 2
  1. Revision 2

    new product

    Changed: affected_products, iocs, lastmod, references, updates

    Sources: 1

Arista Networks has released security patches for CVE-2026-114625, a critical-severity SQL injection vulnerability in the VeloCloud Orchestrator (VCO) on-premises management tool. The vulnerability enables an authenticated user with low-level tenant role privileges to escalate to a superuser operator, granting unauthorized access to privileged internal functionality. Arista has confirmed active exploitation in the wild.

Impact

Successful exploitation results in the compromise of the VCO host, allowing attackers to access internal-only management functionality, masquerade as a superuser, and impact the confidentiality, integrity, and availability of the orchestrator and its managed data.

Recommendation

  • Upgrade on-premises VCO installations immediately to version 5.2.3.18, 6.1.3.10, 6.4.2.12, or later.
  • Block inbound traffic from malicious IP addresses 74.82.197.86 and 38.54.50.151 at the network perimeter.
  • Review VCO web access, backend, and database logs for anomalous request patterns originating from existing authenticated sessions.
  • Restrict access to the VCO web interface to trusted management networks until patches are applied.

Immediate actions

Block 74.82.197.86 and 38.54.50.151 at network edge

SOC immediate

Threat Hunt

Identify authenticated sessions with unusual request velocity or payload signatures

T1068 high high confidence hunt now

Data: VCO web access logs, Backend application logs

Mitigations

Upgrade VeloCloud Orchestrator to version 5.2.3.18, 6.1.3.10, or 6.4.2.12

immediate IT Operations

CVE-2026-114625

Detection coverage 1

Detect CVE-2026-114625 Exploitation - Potential SQL Injection

critical

Detects potential SQL injection attempts against VeloCloud Orchestrator by monitoring for common SQL meta-characters or keywords in URI queries associated with authenticated sessions.

sigma tactics: privilege_escalation techniques: T1068 sources: webserver

Detection queries are available on the platform. Get full rules →

Indicators of compromise

2

ip

TypeValue
ip74.82.197.86
ip38.54.50.151