--- schema: 1 kind: vulnerability title: "CVE-2026-114625, Arista VeloCloud Orchestrator On-Prem: an SQL injection lets any authenticated user, down to the Enterprise Read Only role, act as a superuser operator, and Arista says it is actively exploited (CVSS 3.1 9.9)" headline: "Arista confirms exploitation of a VeloCloud Orchestrator flaw: any tenant login, even read-only, reaches operator rights" summary: > Arista's Security Advisory 0199 of 2026-10-22 fixes CVE-2026-114625 (CVSS 3.1 9.9) in on-premises VeloCloud Orchestrator: any authenticated user, down to the lowest built-in tenant role, can gain operator privileges and reach functions meant for internal use only, and Arista says the flaw is known to be actively exploited. Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12; hosted and dedicated Orchestrators were already patched, and Arista names no actor, victim count or start date. discovered_at: "2026-10-23T03:31:00Z" updated_at: null event_date: "2026-10-22" run_id: 2026-10-23T0256Z-intel priority: high immediate_action: null tags: [vulnerabilities, actively-exploited, priv-esc, sqli, patch-available] regions: [global] sectors: [] entities: ["product:arista-velocloud-orchestrator-on-prem"] techniques: [T1190, T1068] affected_products: ["Arista VeloCloud Orchestrator On-Prem"] cves: - id: CVE-2026-114625 cvss: "9.9 (CVSS 3.1) / 9.4 (CVSS 4.0)" epss: null type: sqli vector: zero-click auth: post-auth status: [exploited, patch-available] affected: "on-prem VeloCloud Orchestrator 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12 (end-of-support releases not assessed)" fixed: "5.2.3.18, 6.1.3.10 and 6.4.2.12 (and later in each train)" sources: - url: "https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199" publisher: "Arista Networks (Security Advisory 0199)" date: "2026-10-22" role: primary - url: "https://www.arista.com/assets/data/SecurityAdvisories/CSAF/arista_networks_security_advisory_199_CSAF.json" publisher: "Arista Networks (CSAF for Security Advisory 0199)" date: "2026-10-22" role: corroborating closed_sources: [] evidence: - quote: "This issue was detected by Arista and is known to be actively exploited." publisher: "Arista Networks (Security Advisory 0199)" source_url: "https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199" - quote: "On an affected system, any authenticated user can gain operator privileges and masquerade as a local “superuser operator” user." publisher: "Arista Networks (Security Advisory 0199)" source_url: "https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199" - quote: "A successful attack requires network access to the VCO web interface and a valid authenticated session on the VCO portal." publisher: "Arista Networks (Security Advisory 0199)" source_url: "https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199" verification: single-source sourcing_note: > Arista's advisory is the first-party source for its own product and for the exploitation statement; its CSAF file repeats the CVSS 3.1 score and the mitigation text. No independent report of the exploitation had been found as of 2026-10-23. confidence: high references: ["2026-09-23/cve-2026-93952-arista-velocloud-orchestrator-exploited", "2026-07-28/cve-2026-16812-arista-velocloud-orchestrator-exploited"] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Upgrade every on-premises VeloCloud Orchestrator to 5.2.3.18, 6.1.3.10 or 6.4.2.12 (or later in its train) now and, until then, restrict its web interface to trusted administrative networks; before upgrading, preserve the web access, application, system and database logs and the file-system timestamps, then check the host for backdoor daemons, web shells and unexpected outbound traffic." updates: [] migrated_from: null --- Arista's Security Advisory 0199 of 2026-10-22 covers CVE-2026-114625 (CVSS 3.1 9.9, CVSS 4.0 9.4, CWE-89 SQL injection) in the on-premises VeloCloud Orchestrator (VCO): on an affected system any authenticated user can gain operator privileges and masquerade as a local "superuser operator", which includes access to functionality intended for internal use only and not for remote access ([Arista Networks, 2026-10-22](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)). Arista states that it detected the issue and that it is known to be actively exploited, and the advisory names no actor, victim count or start date ([Arista Networks, 2026-10-22](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)). The prerequisite is network access to the VCO web interface and a valid session on the VCO portal; the lowest role that suffices is Enterprise Read Only, the lowest built-in tenant role, the interface is exposed by default and no configuration prevents the exposure ([Arista Networks, 2026-10-22](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)). Affected are VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12, and end-of-support releases were not assessed; hosted and dedicated VCO were affected and are already patched, while VeloCloud Gateway and VeloCloud Edge are not affected ([Arista Networks, 2026-10-22](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)). Arista's recommended resolution is the upgrade, and for an unsupported release train it points customers to its support centre to discuss upgrade options ([Arista Networks, 2026-10-22](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)); its CSAF file records the CVSS 3.1 score and the same interim measures, and describes the flaw as "VeloCloud Orchestrator Remote Code Execution (VCO RCE)" where the advisory page names an SQL injection that grants operator privileges; Arista does not say how the two descriptions relate ([Arista Networks CSAF, 2026-10-22](https://www.arista.com/assets/data/SecurityAdvisories/CSAF/arista_networks_security_advisory_199_CSAF.json)). **Exposure:** an on-premises VCO on one of the three trains above, reachable at its web interface by anyone who holds a portal login of any role, a customer-tenant account included; Arista's list is by train, so compare each Orchestrator against the three fixed releases ([Arista Networks, 2026-10-22](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)). **Detection:** web access logs of the VCO for requests with unusual URL-like path components, encoded characters, references to local or internal services and high request rates; outbound connections from the VCO host that the Orchestrator does not normally make; backdoor daemons and web shells on the host; and recent administrator activity for changes nobody made ([Arista Networks, 2026-10-22](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)). Arista asks operators to preserve the web, application, system and database logs and the file-system timestamps before remediation where feasible, and its advisory does not say that the upgrade removes a foothold that is already there ([Arista Networks, 2026-10-22](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)). **Triage:** a session authenticated as a low-privilege tenant account, Enterprise Read Only above all, that reaches operator-only or internal-only functions is the signal, because legitimate operators act from their own accounts; Arista lists attacker source addresses in its advisory ([Arista Networks, 2026-10-22](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)). **Defender takeaway:** upgrade the Orchestrator to a fixed release of its train now, restrict the web interface to administrative networks in the meantime, and on any Orchestrator that was reachable and unpatched keep the logs first and then check the host for backdoor daemons and web shells.