VeloCloud Orchestrator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CVE-2026-114625)

What is affected, what to do

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

The vulnerability is being actively exploited; treat it as a priority. Update Arista Networks VeloCloud Orchestrator to version 5.2.3.18, Arista Networks VeloCloud Orchestrator to version 6.1.3.10, Arista Networks VeloCloud Orchestrator to version 6.4.2.12. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Arista Networks VeloCloud Orchestrator lt 5.2.0..5.2.3.18
• Arista Networks VeloCloud Orchestrator lt 6.1.0..6.1.3.10
• Arista Networks VeloCloud Orchestrator lt 6.4.0..6.4.2.12

Fixed in

• Arista Networks VeloCloud Orchestrator 5.2.3.18
• Arista Networks VeloCloud Orchestrator 6.1.3.10
• Arista Networks VeloCloud Orchestrator 6.4.2.12

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Enumerate every on-prem VeloCloud Orchestrator (VCO) and confirm its exact build (admin portal → About/system info). Hosted and Dedicated VCO have already been patched by the vendor. For those, skip patching but still run the compromise hunt below.

   • Patch: Upgrade each affected instance to at least the fixed build for its release train:

     • 5.2.x to 5.2.3.18,
     • 6.1.x to 6.1.3.10,
     • 6.4.x to 6.4.2.12.

     Check Arista's vendor advisory for upgrade paths and prerequisites.

   • Cut exposure: If you can't patch within hours, block access to the VCO portal and API (HTTPS) from the internet and user networks immediately. Allow only management jump hosts and edge traffic.

   • Clean up accounts: Audit all enterprise, partner and operator-level VCO users. Disable unused accounts and revoke API tokens. Any authenticated identity is enough to escalate to the "superuser operator".

   • Rotate credentials: After patching, reset passwords and API tokens for all privileged VCO accounts. Also rotate secrets the orchestrator stores, such as RADIUS/SNMP secrets and cloud gateway keys.

   • Preserve evidence: Snapshot or back up the VCO VM and collect web and application logs before upgrading, so forensic artefacts survive.

2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place the VCO in a dedicated management segment. Permit inbound HTTPS only from:

     • defined admin subnets or jump hosts,
     • your own edges' public IPs.

     Restrict the VCO host's outbound traffic to required destinations (updates, NTP, syslog). This hampers tool staging and exfiltration.

   • WAF/IPS: Front the portal with a reverse proxy or WAF running SQLi rule sets (e.g. OWASP CRS at paranoia level ≥ 2). Inspect JSON bodies of API calls under /portal/. Block on UNION SELECT, SLEEP(, BENCHMARK(, information_schema and stacked-query patterns.

   • IAM/least privilege: Minimise VCO accounts and enforce SSO with MFA where supported. Remove shared service and customer logins. Temporarily suspend partner and customer access (MSP scenarios) until patched.

   • Host hardening: Allow SSH and console access to the VCO host only via a jump host. Check local root and system accounts for unknown keys in authorized_keys. Keep database access local-only.

   • Edge protection: Review configuration changes pushed from the VCO to edges through change control. A compromised orchestrator can distribute malicious configs, routes or firmware to every site.

3. 03

   Runbook step 3

   Detection rules

   • Web and API logs: Search VCO or proxy access logs for SQL metacharacters and function names in requests to /portal/. Example SPL: index=vco sourcetype=nginx uri="/portal/*" | regex _raw="(?i)(union\s+select|sleep\(|benchmark\(|information_schema|0x[0-9a-f]{8,})" Also watch for latency spikes (time-based SQLi) and HTTP 500 bursts per source IP.
   • Application audit: Alert on:
     • new operator accounts, role changes to operator or superuser level, and newly issued API tokens,
     • "superuser operator" logins from unusual source IPs,
     • operator-level actions that follow shortly after requests from low-privilege accounts.
   • Linux host (auditd/EDR): Monitor the process ancestry of the web or Node service. Alert on child processes such as sh, bash, curl, wget, python or nc. Add auditd watches (-w /etc/passwd, -w /root/.ssh, execve on the service user) to catch new accounts and keys.
   • Network telemetry (Zeek/Suricata): Flag new outbound connections from the VCO host to unfamiliar destinations. Unusually large portal responses to a single client may indicate a database dump.
   • Edge side: Correlate unexpected config pushes, software updates or new business policies on edges with the VCO audit log.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Source: BSI WID Portal

Vendors and products

• Arista Networks VMware SD-WAN by VeloCloud
• Arista Networks

Weakness classes (CWE)

• CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  Base

  The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

  Entry at MITRE CWE-89

References & sources

• arista.comSecurity Advisory 0199Vendor advisory, Mitigation, Vendor advisory, pwn-watch
• cisa.govCISA KEV: CVE-2026-114625government-resource, US government resource, pwn-watch
• pwn.watchpwn.watch: Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attackspwn-watch
• NVD (NIST)NVD: CVE-2026-114625pwn-watch
• thehackernews.comArista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attackspwn-watch
• bleepingcomputer.comArista patches new VeloCloud Orchestrator zero-day exploited in attackspwn-watch
• securityonline.infoVeloCloud Orchestrator Vulnerability Exploited in the Wildpwn-watch
• advisories.ncsc.nlNCSC-2026-0385pwn-watch
• securityweek.comAttackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Monthspwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 24.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-114625","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T17:50:04.453349Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-114625","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-22T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 23.10.2026Initial analysis by NVDNVD

   Newly listed as affected:

   • Arista Networks VMware SD-WAN by VeloCloud (5.2.0 – before 5.2.3.18; 6.1.0 – before 6.1.3.10; 6.4.0 – before 6.4.2.12)

   New references:

   • https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	added	—	OR *cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* versions from (including) 5.2.0 up to (excluding) 5.2.3.18 *cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* versions from (including) 6.1.0 up to (excluding) 6.1.3.10 *cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* versions from (including) 6.4.0 up to (excluding) 6.4.2.12
   Reference type	added	—	Arista Networks, Inc.: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 Types: Mitigation, Vendor Advisory
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625 Types: US Government Resource

   Source identifier: nvd@nist.gov

3. 23.10.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-10-23
   Due Date	added	—	2026-10-23
   Required Action	added	—	2026-10-23
   Vulnerability Name	added	—	2026-10-23

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

4. 23.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625
   SSVC assessment	removed	{"id":"CVE-2026-114625","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-22T00:00:00+00:00"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-114625","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T17:50:04.453349Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 23.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: none known, automatable: no

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-114625","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-22T23:06:06.826012Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-114625","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-22T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

One NVD translation into another language is hidden.