Summary

Arista Networks has patched CVE-2026-114625, a critical SQL injection flaw in VeloCloud Orchestrator (VCO) On-Prem that attackers were already exploiting before a fix existed. VCO is the web portal used to configure, monitor, and manage VeloCloud SD-WAN networks and the edge devices behind them, so whoever controls it controls a lot. The flaw lets any logged-in user, even one holding the lowest built-in tenant role, escalate to a local "superuser operator" account and reach internal functions that were never meant to be exposed. Hosted and Dedicated deployments have already been fixed, leaving on-premises customers to upgrade, since there is no configuration workaround and the web interface is exposed by default. With exploitation already underway and no workaround available, upgrading to VCO 5.2.3.18, 6.1.3.10, or 6.4.2.12 should be treated as an emergency task rather than a routine patch.

CVEs

Vulnerability Details

Affected products and CPE

Recommendations

1. 01
   Upgrade to a Fixed VCO Release Immediately

   Move affected on-premises orchestrators to VCO 5.2.3.18 or later on the 5.2 train, 6.1.3.10 or later on the 6.1 train, or 6.4.2.12 or later on the 6.4 train. This is the only complete fix, since Arista confirms no configuration change can remove the exposure. If your deployment sits on an unsupported release train, contact the Arista Networks Technical Assistance Center to discuss an upgrade path rather than waiting, because end-of-support versions have not been assessed and should be presumed vulnerable.
2. 02
   Block the Known Attacker Infrastructure and Hunt Backwards

   Block the two IP addresses Arista observed conducting these attacks at your perimeter, then search historical VCO logs for any prior connections from them. A hit in older logs changes this from a patching exercise into an incident response engagement, so treat log review as a detection activity and not just a blocking formality.
3. 03
   Restrict Access to the VCO Web Interface

   Limit reachability of the orchestrator's web interface to trusted administrative networks using firewall rules, VPN enforcement, or jump host access. This will not close the vulnerability, but it meaningfully shrinks the pool of attackers who can present a valid session, and it buys time if an upgrade window cannot be scheduled immediately.
4. 04
   Hunt for Persistence on the VCO Host

   Arista specifically recommends monitoring for backdoor daemons and web shells, which indicates attackers are establishing footholds rather than making a single smash-and-grab. Review the host for unexpected processes and services, check web directories for files that do not belong, and watch for unexpected outbound network activity from the orchestrator. Consider blocking outbound ports that normal operation does not require.
5. 05
   Preserve Evidence Before You Remediate

   If there is any suspicion of compromise, capture VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before patching or rebuilding. Remediation frequently destroys exactly the artifacts an investigation depends on, and once they are gone there is no way to reconstruct what an attacker touched.
6. 06
   Review Administrator Activity and Tenant Accounts

   Because the flaw lets a user with the lowest tenant role become a superuser operator, go back through recent administrator activity for configuration changes, new accounts, or permission grants that nobody on your team can explain. Take the opportunity to audit which tenant accounts still need access at all, as every dormant low-privilege account is a usable entry point for this class of flaw.

Indicators of Compromise (IoCs)

MITRE ATT&CK TTPs

References & Patch Links

Patch links

• https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

References

• https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199