Threat reportVulnerabilityTL-2026-4166
Arista VeloCloud Orchestrator SQL Injection Zero-Day (CVE-2026-114625) Exploited in Attacks
Arista VeloCloud Orchestrator SQL Injection Zero-Day (TL-2026-4166) is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-10-22. It has no confirmed attribution, affects Arista Networks VeloCloud Orchestrator (VCO) On-Prem, references 3 CVEs (CVE-2026-114625, CVE-2026-16812, CVE-2026-93952), maps to 5 MITRE ATT&CK techniques (T1005, T1078, T1190), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 9.9/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-4166
- Threat ID
- TL-2026-4166
- Severity
- CRITICAL
- CVSS
- 9.9
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecoms, enterprise, managed-service-providers, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 6
How Arista VeloCloud Orchestrator SQL Injection Zero-Day works
Arista patched a critical SQL injection flaw (CVE-2026-114625, reported CVSS 9.9) in on-premises VeloCloud Orchestrator (VCO) that Arista detected being actively exploited as a zero-day. Any authenticated user, including a read-only tenant login, can escalate to operator privileges and masquerade as a local 'superuser operator'.
CVE-2026-114625 is an authenticated SQL injection (CWE-89) in the on-premises VeloCloud Orchestrator (VCO), the management plane for Arista VeloCloud SD-WAN. Per Arista Security Advisory 0199 (published 2026-10-22) and press coverage, any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user, reaching internal functionality that was never meant to be remotely accessible. Successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. SecurityOnline reports that a read-only tenant login (the Enterprise Read Only role) is sufficient, and that VCO is exposed by default with no configuration to prevent exposure. BleepingComputer describes the attack as low complexity with no user interaction.
Arista states the flaw was detected by Arista and is known to be actively exploited. Hosted and dedicated VCO instances were patched by Arista; on-prem customers must upgrade themselves. Fixed releases are VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later. VeloCloud Gateway, VeloCloud Edge and Arista EOS are not affected.
Arista published two attacker source IPs: 74.82.197.86 and 38.54.50.151. No malware family, post-exploitation tooling or threat-actor attribution has been published. This is the fourth VCO zero-day Arista has patched in 2026, after CVE-2026-7473 (May), CVE-2026-16812 (July, unauthenticated OS command injection, CVSS 10.0, added to CISA KEV on 2026-07-27) and CVE-2026-93952 (September). Those are separate CVEs with their own IOCs; their IOCs are deliberately not merged into this record. KEV listing of CVE-2026-114625 was not confirmed in the sources reviewed. Arista's guidance and the press recommend restricting the VCO web interface to administrative networks, reviewing administrator activity logs, and examining web access logs for suspicious requests, encoded characters and unusual URL patterns. SecurityOnline also advises watching for suspicious outbound traffic, backdoors, webshells and admin activity changes. Because the full advisory text did not state CVSS vector details, the vector is left null rather than inferred.
MITRE ATT&CK techniques used in TL-2026-4166
Collection
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Persistence
T1505.003 Server Software Component: Web Shell
Privilege Escalation
Affected products and versions in Arista VeloCloud Orchestrator SQL Injection Zero-Day
- Arista Networks — VeloCloud Orchestrator (VCO) On-Prem
Vulnerable versions: 5.2.x before 5.2.3.18; 6.1.x before 6.1.3.10; 6.4.x before 6.4.2.12
Fixed in: 5.2.3.18; 6.1.3.10; 6.4.2.12
Remediation for Arista VeloCloud Orchestrator SQL Injection Zero-Day
Patches
- VCO 5.2.3.18 or later (5.2 train)
- VCO 6.1.3.10 or later (6.1 train)
- VCO 6.4.2.12 or later (6.4 train)
- Arista Security Advisory 0199
Immediate actions
- Upgrade on-prem VeloCloud Orchestrator to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later
- Restrict the VCO web interface to administrative/trusted networks
- Block and review historical connections from 74.82.197.86 and 38.54.50.151
- Review administrator activity logs for unexpected operator or superuser activity
- Examine web access logs for suspicious requests, encoded characters and unusual URL patterns
Workarounds
- No configuration workaround published; restrict network access to the VCO web interface until patched
Longer-term hardening
- Do not expose the VCO management interface to the internet
- Audit low-privilege and read-only tenant accounts and enforce strong authentication
- Monitor VCO hosts for suspicious outbound traffic, backdoors, webshells and admin changes
CVEs associated with Arista VeloCloud Orchestrator SQL Injection Zero-Day
Weaknesses (CWE) in Arista VeloCloud Orchestrator SQL Injection Zero-Day
Timeline of Arista VeloCloud Orchestrator SQL Injection Zero-Day
- Context: CISA adds the earlier VCO zero-day CVE-2026-16812 (unauthenticated OS command injection, CVSS 10.0) to the KEV catalog; Arista reports active exploitation.
- Context: Fixes for CVE-2026-16812 released in VCO 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1.
- Attacker IPs 74.82.197.86 and 38.54.50.151 published for blocking and log review; BleepingComputer and SecurityOnline report the zero-day, noting this is the fourth VCO zero-day of 2026 (after CVE-2026-7473, CVE-2026-16812, CVE-2026-93952).
- Fixed VCO releases 5.2.3.18, 6.1.3.10 and 6.4.2.12 made available for on-prem customers.
- Arista publishes Security Advisory 0199 for the on-prem VCO vulnerability, reporting loss of confidentiality, integrity and availability risk.
- Arista states CVE-2026-114625 was detected by Arista and is known to be actively exploited; hosted and dedicated VCO instances already patched.
Sources cited for Arista VeloCloud Orchestrator SQL Injection Zero-Day
- Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
- Arista Security Advisory 0199
- Arista Warns VeloCloud Orchestrator Flaw CVE-2026-114625 Is Exploited in the Wild
- Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day (CVE-2026-16812, prior VCO zero-day)
- CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to KEV (CVE-2026-16812, prior VCO zero-day)
- Critical Zero-Day Hits Arista VeloCloud Orchestrator (CVE-2026-16812, prior VCO zero-day)
- New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups (CVE-2026-93952, prior VCO zero-day)
Detection coverage for TL-2026-4166
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4166 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.