{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/velocloud-orchestrator--5.2.3.18--6.1.3.10--6.4.2.12/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-114625"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VeloCloud Orchestrator (\u003c 5.2.3.18, 6.1.3.10, 6.4.2.12)","VeloCloud Orchestrator (\u003c 5.2.3.18, \u003c 6.1.3.10, \u003c 6.4.2.12)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Arista"],"content_html":"\u003cp\u003eArista Networks has released security patches for CVE-2026-114625, a critical-severity SQL injection vulnerability in the VeloCloud Orchestrator (VCO) on-premises management tool. The vulnerability enables an authenticated user with low-level tenant role privileges to escalate to a superuser operator, granting unauthorized access to privileged internal functionality. Arista has confirmed active exploitation in the wild.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the compromise of the VCO host, allowing attackers to access internal-only management functionality, masquerade as a superuser, and impact the confidentiality, integrity, and availability of the orchestrator and its managed data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade on-premises VCO installations immediately to version 5.2.3.18, 6.1.3.10, 6.4.2.12, or later.\u003c/li\u003e\n\u003cli\u003eBlock inbound traffic from malicious IP addresses 74.82.197.86 and 38.54.50.151 at the network perimeter.\u003c/li\u003e\n\u003cli\u003eReview VCO web access, backend, and database logs for anomalous request patterns originating from existing authenticated sessions.\u003c/li\u003e\n\u003cli\u003eRestrict access to the VCO web interface to trusted management networks until patches are applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T11:26:29Z","date_published":"2026-10-23T10:36:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-velocloud-orchestrator-sqli/","summary":"Arista VeloCloud Orchestrator (VCO) is under active exploitation by attackers using a critical SQL injection vulnerability (CVE-2026-114625) to escalate from low-privilege tenant accounts to superuser operator status.","title":"Arista VeloCloud Orchestrator: SQL Injection Privilege Escalation (CVE-2026-114625)","url":"https://feed.craftedsignal.io/briefs/2026-10-velocloud-orchestrator-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - VeloCloud Orchestrator (\u003c 5.2.3.18, \u003c 6.1.3.10, \u003c 6.4.2.12)","version":"https://jsonfeed.org/version/1.1"}