CVE-2026-114625 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-22

Added to CISA KEV: 2026-10-23 1 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — ACTIVE EXPLOITATION IN THE WILD: Treat this as an emergency incident response situation. Immediately audit VCO logs for unexpected privilege escalations, unusual API calls to internal/operator endpoints, and authentication events from unexpected source IPs.
PATCH IMMEDIATELY: Upgrade to VCO 5.2.3.18+ (5.2 train), 6.1.3.10+ (6.1 train), or 6.4.2.12+ (6.4 train). Do not delay — active exploitation is confirmed.
NETWORK ISOLATION: As an immediate interim measure before patching, restrict VCO web interface access to a trusted allowlist of administrative source IPs/networks using firewall ACLs or network segmentation. This is the most impactful compensating control available.
CREDENTIAL AUDIT: Review all VCO user accounts for unauthorized privilege escalation. Look for accounts that unexpectedly hold operator or superuser operator roles. Disable or reset any suspicious accounts immediately.
IOC HUNTING: Obtain indicators of compromise (IOCs) from threat intelligence vendors and Arista's advisory. Search VCO logs and network flow data for matching indicators of active compromise.
MONITOR FOR POST-EXPLOITATION: Watch for backdoor daemons, web shells, unexpected outbound connections, and modifications to VCO configuration. The vulnerability can impact the underlying host — extend monitoring beyond the VCO application layer to the host OS.
BLOCK UNNECESSARY OUTBOUND PORTS: Per Arista's workaround guidance, consider blocking outbound ports from the VCO host that are not required for normal SD-WAN operations to limit post-exploitation blast radius.
THREAT INTELLIGENCE: Given this is the third exploited VCO zero-day in four months, assume adversaries have established tooling specifically targeting this platform. Engage threat intelligence resources to assess exposure and check for prior compromise.
PATCH PRIORITY: CRITICAL — treat as P0/emergency patch. Do not defer to standard patch cycle.

🔍 Web Intelligence (Kagi · 2026-10-23)

Summary

CVE-2026-114625 is a critical SQL injection vulnerability affecting on-premises deployments of the Arista VeloCloud Orchestrator (VCO) ^[1]^[5]. The flaw allows an authenticated user, regardless of their original privilege level, to execute arbitrary SQL commands to escalate their account to "superuser operator" status ^[2]^[5]. This is a significant issue as it grants attackers full control over the orchestrator and access to restricted internal functions, posing a high risk for organizations relying on these systems for network management ^[1]^[2].

Exploitation

Active Exploitation: The vulnerability is currently being exploited in the wild as a zero-day attack ^[4]^[8].
Threat Actors: While specific named threat actors have not been definitively linked in available reports, it is noted as the third exploited zero-day targeting Arista VCO in four months, suggesting persistent interest from malicious entities ^[4].
Availability: Proof-of-concept information and indicators of compromise (IOCs) are being shared among security researchers and threat intelligence vendors to aid in detection and hunting ^[3]^[7].
Prerequisites: Exploitation requires an existing user account on the affected VCO system, even if the account holds the lowest possible (read-only) role; no specific local access or complex user interaction beyond the initial authentication is required to initiate the attack ^[3]^[5].

Affected Products & Patches

Affected Versions: All on-premises deployments of Arista VeloCloud Orchestrator (VCO) are affected ^[1].
Patches: Administrators should consult the official Arista Security Advisory 0199 for the latest patched versions and apply the necessary software updates immediately ^[1].
Mitigations: In addition to patching, organizations should monitor for suspicious authentication patterns and audit existing user accounts for unauthorized privilege escalation; further technical mitigations are detailed in the vendor's advisory ^[3].

Impact

Access & Capability: Successful exploitation allows an attacker to masquerade as a "superuser operator," providing full access to internal VCO functions, configuration data, and orchestrator controls, and potentially allowing further compromise of the underlying host system ^[2]^[6].
Business Risk: For internet-facing deployments, this vulnerability presents a severe risk, as it effectively bridges the gap between a compromised low-privileged account and full administrative control over the enterprise network management plane, facilitating potential data exfiltration or total system takeover ^[1]^[2].

Sources

Security Advisory 0199
October 22, 2026 VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged ... October 22, 2026 VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal funct…
CVE-2026-114625 - Vulnerability Details - OpenCVE
VeloCloud Orchestrator (VCO) on‑prem is affected by a privilege escalation flaw that allows an authenticated user to gain operator privileges and impersonate a “superuser operator”. This privileged level grants access to internal functions that are normally restricted, potentially exposing configura…
Arista VeloCloud Orchestrator CVE-2026-114625: Exploited SQL Injection
CVE-2026-114625 lets any VeloCloud Orchestrator login, even read only, become superuser operator. Exploited. Fixed builds, IOCs, KEV status, hunting steps.
Attackers Exploit Third Arista VCO Zero-Day in Four Months
CVE-2026-114625 is the third exploited zero-day vulnerability Arista patches in VCO in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.
Arista Velocloud Sql Injection Zero Day Cve 2026 114625 ...
CVE-2026-114625 is a SQL injection flaw that allows any authenticated VCO user—even those with the lowest read-only role—to escalate privileges ...

🔴 CVE-2026-114625