Loading vulnerability…
Authenticated SQL Injection and Privilege Escalation in Arista VeloCloud Orchestrator
CVE-2026-114625 is a SQL injection vulnerability in Arista VeloCloud Orchestrator (VCO) that allows a remote authenticated user to gain operator privileges and impersonate a local superuser operator. Even the lowest built-in tenant role, Enterprise Read Only, is sufficient. Exploitation exposes privileged internal functionality not intended to be remotely accessible and may compromise the VCO host and managed data. Affected on-premises releases are 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12. Hosted deployments, including Dedicated instances, were also affected but have already been patched. Arista confirmed active exploitation, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. The vulnerability has CVSS v3.1 and v4.0 scores of 9.9 and 9.4, respectively.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator, its host, and the data it manages. An attacker with minimal tenant privileges can cross the intended authorization boundary to obtain superuser operator access and invoke privileged internal functions. Because VCO centrally manages SD-WAN environments, compromise can also threaten the configurations and operational security of managed infrastructure.
If you can’t patch tonight, do this now.
Until fixed software is deployed, restrict VCO web-interface access to trusted administrative networks and remove unnecessary public exposure. No product configuration eliminates the underlying vulnerability. Review web access logs for unusual encoded requests, references to internal services, and abnormal request rates; audit unexpected administrator changes and authenticated sessions. Investigate abnormal outbound connections, backdoor services, and webshells, and restrict unnecessary outbound connectivity. If compromise is suspected, preserve web access, application, system, and database logs and relevant file-system timestamps before remediation where operationally feasible. These controls reduce exposure but do not replace upgrading.
Patch, then assume compromise.
Upgrade affected on-premises deployments to VCO 5.2.3.18 or later in the 5.2 release train, 6.1.3.10 or later in the 6.1 train, or 6.4.2.12 or later in the 6.4 train. Verify the running version after upgrading. End-of-support releases were not assessed; contact Arista Technical Assistance Center for an appropriate supported upgrade path. Hosted and Dedicated deployments have already been patched. Conduct a parallel compromise assessment because installing the fix does not remove an existing intrusion; perform incident response if compromise is identified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
117 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.