# Arista VeloCloud Orchestrator SQL Injection Zero-Day (CVE-2026-114625) Exploited in Attacks

> Arista patched a critical SQL injection flaw (CVE-2026-114625, reported CVSS 9.9) in on-premises VeloCloud Orchestrator (VCO) that Arista detected being actively exploited as a zero-day. Any authenticated user, including a read-only tenant login, can escalate to operator privileges and masquerade as a local 'superuser operator'.

- **Published:** 2026-10-22T17:36:33Z
- **Last reviewed:** 2026-10-22T17:36:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4166
- **ID:** TL-2026-4166
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-114625, CVE-2026-16812, CVE-2026-93952

## Description

CVE-2026-114625 is an authenticated SQL injection (CWE-89) in the on-premises VeloCloud Orchestrator (VCO), the management plane for Arista VeloCloud SD-WAN. Per Arista Security Advisory 0199 (published 2026-10-22) and press coverage, any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user, reaching internal functionality that was never meant to be remotely accessible. Successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. SecurityOnline reports that a read-only tenant login (the Enterprise Read Only role) is sufficient, and that VCO is exposed by default with no configuration to prevent exposure. BleepingComputer describes the attack as low complexity with no user interaction.

Arista states the flaw was detected by Arista and is known to be actively exploited. Hosted and dedicated VCO instances were patched by Arista; on-prem customers must upgrade themselves. Fixed releases are VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later. VeloCloud Gateway, VeloCloud Edge and Arista EOS are not affected.

Arista published two attacker source IPs: 74.82.197.86 and 38.54.50.151. No malware family, post-exploitation tooling or threat-actor attribution has been published. This is the fourth VCO zero-day Arista has patched in 2026, after CVE-2026-7473 (May), CVE-2026-16812 (July, unauthenticated OS command injection, CVSS 10.0, added to CISA KEV on 2026-07-27) and CVE-2026-93952 (September). Those are separate CVEs with their own IOCs; their IOCs are deliberately not merged into this record. KEV listing of CVE-2026-114625 was not confirmed in the sources reviewed. Arista's guidance and the press recommend restricting the VCO web interface to administrative networks, reviewing administrator activity logs, and examining web access logs for suspicious requests, encoded characters and unusual URL patterns. SecurityOnline also advises watching for suspicious outbound traffic, backdoors, webshells and admin activity changes. Because the full advisory text did not state CVSS vector details, the vector is left null rather than inferred.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1548 Abuse Elevation Control Mechanism
- T1505.003 Server Software Component: Web Shell
- T1005 Data from Local System

## Sources

- [Arista patches new VeloCloud Orchestrator zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/)
- [Arista Security Advisory 0199](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)
- [Arista Warns VeloCloud Orchestrator Flaw CVE-2026-114625 Is Exploited in the Wild](https://securityonline.info/velocloud-orchestrator-cve-2026-114625-exploited/)
- [Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day (CVE-2026-16812, prior VCO zero-day)](https://www.securityweek.com/critical-arista-velocloud-orchestrator-vulnerability-exploited-as-zero-day/)
- [CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to KEV (CVE-2026-16812, prior VCO zero-day)](https://securityaffairs.com/196130/security/u-s-cisa-adds-arista-velocloud-orchestrator-and-fortinet-fortios-flaws-to-its-known-exploited-vulnerabilities-catalog.html)
- [Critical Zero-Day Hits Arista VeloCloud Orchestrator (CVE-2026-16812, prior VCO zero-day)](https://www.hivepro.com/threat-advisory/critical-zero-day-hits-arista-velocloud-orchestrator)
- [New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups (CVE-2026-93952, prior VCO zero-day)](https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4166