Arista VeloCloud Orchestrator SQL Injection Zero-Day CVE-2026-114625 (CVSS 9.9) Exploited — Any Tenant Login Becomes 'Superuser Operator', the Third VCO Zero-Day in Four Months

Critical · 2026-11-06 · By H.A

Arista has patched an actively exploited SQL injection in on-prem VeloCloud Orchestrator that lets any authenticated user gain superuser-operator control of the SD-WAN, and fixes for the September VCO zero-day do not protect against it.

Overview

Arista has patched CVE-2026-114625, a critical SQL injection flaw in VeloCloud Orchestrator (VCO) On-Prem that attackers exploited before a fix existed. The flaw is rated CVSS v3.1 9.9 (CVSS v4.0 9.4). Any authenticated user, even one with the lowest built-in tenant role, can use it to gain operator privileges and pose as the local "superuser operator". That gives them internal-only functionality on the orchestrator that controls an organization's whole SD-WAN.

It is the third exploited VCO zero-day in about four months, after CVE-2026-16812 in July and CVE-2026-93952 in September. CISA has added the flaw to its Known Exploited Vulnerabilities catalog. Patches for the September bug do not protect against this one.

The Vulnerability

• Type: SQL injection leading to privilege escalation
• Component: VCO On-Prem web interface. Arista has already fixed Hosted and Dedicated deployments.
• Prerequisites: network access to the VCO web UI and a valid session with any role, including the lowest tenant role. No user interaction is needed.
• Impact: operator-level control of the orchestrator, affecting the confidentiality, integrity and availability of VCO and the edge configurations and data it manages
• Exposure: Arista says the vulnerable feature is exposed by default and no configuration setting mitigates it.
• Affected: all VCO On-Prem releases earlier than 5.2.3.18, 6.1.3.10 and 6.4.2.12
• Fixed: 5.2.3.18, 6.1.3.10, 6.4.2.12 and later (Arista Security Advisory 0199)

From an attacker's point of view, the orchestrator is the most valuable part of an SD-WAN. Operator access can change routing and VPN policy, push configuration to every branch edge, and give a starting point for moving into the networks behind them.

Timeline

• July 2026: CVE-2026-16812, a command-injection zero-day in on-prem VCO, is exploited and patched.
• September 2026: CVE-2026-93952 (CVSS 10.0), an input-validation flaw that exposes privileged functionality, is exploited and patched.
• 22 October 2026: Arista publishes Security Advisory 0199 for CVE-2026-114625 and confirms active exploitation.
• 23 October 2026 (reported): CISA adds the flaw to the KEV catalog with a short federal remediation deadline. Some reports disagree about the exact listing date.
• Today: any on-prem VCO not yet on a fixed build should be considered at risk.

Tradecraft

Arista has not named the attackers or said how many customers were hit. Its guidance gives a picture of the activity:

• Exploitation needs only a low-privileged login. Attackers may use stolen or reused tenant credentials, or accounts created during earlier VCO intrusions.
• Exploit traffic shows high request rates, request paths containing URL-like components, encoded characters, and references to local or internal services.
• After exploitation, Arista recommends hunting for backdoor daemons and web shells on the VCO host. Its advice to block outbound ports suggests attackers tried to set up callbacks or tunnels.

Indicators of Compromise

Source IPs observed in the attacks:

• 74.82.197[.]86
• 38.54.50[.]151

Detection

• Search VCO web access logs for the IPs above, and for bursts of requests from a single low-privilege session that contain encoded characters or internal hostnames such as localhost and 127.0.0.1.
• Review audit logs for privilege changes, newly created operator or superuser accounts, and configuration pushes or VPN/route changes no one requested.
• On the VCO host, look for unexpected listening services, new systemd units or cron jobs, and recently modified files in web-served directories.

# Read-only triage on an on-prem VCO host
ss -tlnp
systemctl list-units --type=service --state=running --no-pager
find / -xdev -newermt '2026-10-01' -type f \( -name '*.jsp' -o -name '*.php' -o -name '*.sh' \) 2>/dev/null | head -50

Before you remediate, keep the evidence: VCO web access logs, backend application logs, system logs, database logs and file-system timestamps.

Recommended Actions

1. Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10, 6.4.2.12 or later now. Do not assume that a build fixed for CVE-2026-93952 is safe.
2. Limit access to the VCO web interface to administrative networks or a VPN.
3. Block the listed IPs and restrict outbound connections from the orchestrator.
4. Audit and prune tenant accounts, enforce MFA, and rotate credentials for every VCO user.
5. If you find signs of compromise, contact Arista TAC, rebuild the orchestrator from a known-good image, and check the edge configurations it pushed.

Analyst Assessment

Three exploited zero-days in four months show that someone is deliberately and repeatedly targeting VeloCloud orchestrators. This one needs only a low-privileged session, so credential hygiene now matters as much as patching. An attacker who controls the orchestrator controls every branch it manages, so the impact reaches far beyond one appliance. Organizations still running on-prem VCO should treat it as a high-value asset: patch quickly, keep it off the open internet, and log it continuously.