Overview
CVE-2026-114625 is a critical SQL injection vulnerability affecting Arista VeloCloud Orchestrator (VCO) on-prem deployments. This flaw allows any authenticated user to escalate privileges to a “superuser operator,” accessing internal functionality not intended for remote exposure. The vulnerability is actively being exploited, posing a severe risk to the confidentiality, integrity, and availability of affected systems.
Technical Analysis
- Vulnerability: SQL Injection (CWE-89).
- Impact: Allows authenticated users to gain “superuser operator” privileges, access privileged internal functionality, and compromise confidentiality, integrity, and availability of the VCO host and managed data.
- Attack Vector: Remote, authenticated user (CVSS AV:N, PR:L).
- Affected Products (on-prem only):
- Arista VeloCloud Orchestrator versions
>= 5.2.0 < 5.2.3.18 - Arista VeloCloud Orchestrator versions
>= 6.1.0 < 6.1.3.10 - Arista VeloCloud Orchestrator versions
>= 6.4.0 < 6.4.2.12
- Arista VeloCloud Orchestrator versions
- CVSS 3.1 Score: 9.9 (CRITICAL) –
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. - Note: Hosted and Dedicated versions of VCO were impacted but have already been patched by Arista.
Detection
- Monitor web server access logs for unusual requests containing SQL injection payloads (e.g.,
UNION SELECT,SLEEP(),WAITFOR DELAY,' OR 1=1 --). - Look for repeated authentication attempts or successful logins followed by rapid privilege escalation or access to unusual administrative endpoints.
- Analyze application logs for SQL errors or unexpected database query executions, especially from authenticated user sessions.
- Monitor for changes in user privileges or the creation of new highly privileged accounts within the VeloCloud Orchestrator.
Sigma Detection Rules
⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.
VeloCloud Orchestrator – SQL Injection Pattern in URI
title: VeloCloud Orchestrator - SQL Injection Pattern in URI
id: 9a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects common SQL injection patterns within the URI or query parameters of web requests, potentially targeting Arista VeloCloud Orchestrator.
logsource:
category: webserver
detection:
selection_keywords:
cs-uri-query|contains:
- 'union select'
- 'sleep('
- 'waitfor delay'
- ''' or ''1''=''1'
- 'information_schema'
- 'pg_sleep('
- 'benchmark('
- 'xp_cmdshell'
cs-uri-stem|contains:
- 'union select'
- 'sleep('
- 'waitfor delay'
- ''' or ''1''='
- 'information_schema'
- 'pg_sleep('
- 'benchmark('
- 'xp_cmdshell'
condition: selection_keywords
level: high
Mitigations
- Immediately apply available security patches from Arista. Refer to Arista Security Advisory
24838-security-advisory-0199for specific versions.- For 5.2.x series, upgrade to
5.2.3.18or later. - For 6.1.x series, upgrade to
6.1.3.10or later. - For 6.4.x series, upgrade to
6.4.2.12or later.
- For 5.2.x series, upgrade to
- Implement robust input validation and parameterized queries for all user-supplied input to prevent SQL injection.
- Enforce the principle of least privilege for all users, especially those with access to the VCO interface.
- Regularly review and audit user accounts and their assigned privileges within the VeloCloud Orchestrator.
- Deploy a Web Application Firewall (WAF) to help detect and block common SQL injection attack patterns.
References
https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199https://nvd.nist.gov/vuln/detail/CVE-2026-114625https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625
Indicators of Compromise
| Type | Value | Description |
|---|---|---|
| IP Address | 38.54.50.151 |
Potential malicious IP identified as an indicator of compromise (via https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199) |
| IP Address | 74.82.197.86 |
Potential malicious IP identified as an indicator of compromise (via https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199) |
MITRE ATT&CK
T1190— Exploit Public-Facing ApplicationT1078.003— Local AccountsT1133— External Remote ServicesT1082— System Information DiscoveryT1071— Application Layer ProtocolT1595.002— Vulnerability ScanningT1505.003— Web ShellT1548— Abuse Elevation Control MechanismT1210— Exploitation of Remote ServicesT1098— Account ManipulationT1078— Valid AccountsT1068— Exploitation for Privilege EscalationT1046— Network Service Discovery
🤖 AI Attribution
Generated by
2,135 input / 1,391 output tokens ·
Reviewed and approved by a human analyst before publication
Generated by
gemini-2.5-flash ·2,135 input / 1,391 output tokens ·
Reviewed and approved by a human analyst before publication