VeloCloud Orchestrator (< 5.2.3.18, 6.1.3.10, 6.4.2.12) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/velocloud-orchestrator--5.2.3.18-6.1.3.10-6.4.2.12/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 10:36:30 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArista VeloCloud Orchestrator: SQL Injection Privilege Escalation (CVE-2026-114625)https://feed.craftedsignal.io/briefs/2026-10-velocloud-orchestrator-sqli/Fri, 23 Oct 2026 10:36:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-velocloud-orchestrator-sqli/Arista VeloCloud Orchestrator (VCO) is under active exploitation by attackers using a critical SQL injection vulnerability (CVE-2026-114625) to escalate from low-privilege tenant accounts to superuser operator status.Arista Networks has released security patches for CVE-2026-114625, a critical-severity SQL injection vulnerability in the VeloCloud Orchestrator (VCO) on-premises management tool. The vulnerability enables an authenticated user with low-level tenant role privileges to escalate to a superuser operator, granting unauthorized access to privileged internal functionality. Arista has confirmed active exploitation in the wild.

Impact

Successful exploitation results in the compromise of the VCO host, allowing attackers to access internal-only management functionality, masquerade as a superuser, and impact the confidentiality, integrity, and availability of the orchestrator and its managed data.

Recommendation

  • Upgrade on-premises VCO installations immediately to version 5.2.3.18, 6.1.3.10, 6.4.2.12, or later.
  • Block inbound traffic from malicious IP addresses 74.82.197.86 and 38.54.50.151 at the network perimeter.
  • Review VCO web access, backend, and database logs for anomalous request patterns originating from existing authenticated sessions.
  • Restrict access to the VCO web interface to trusted management networks until patches are applied.
]]>criticalthreat