CVE-2026-114625: Critical SQL Injection in Arista VeloCloud Orchestrator

Overview

CVE-2026-114625 is a critical SQL injection vulnerability affecting Arista VeloCloud Orchestrator (VCO) on-prem deployments. This flaw allows any authenticated user to escalate privileges to a “superuser operator,” accessing internal functionality not intended for remote exposure. The vulnerability is actively being exploited, posing a severe risk to the confidentiality, integrity, and availability of affected systems.

Technical Analysis

• Vulnerability: SQL Injection (CWE-89).
• Impact: Allows authenticated users to gain “superuser operator” privileges, access privileged internal functionality, and compromise confidentiality, integrity, and availability of the VCO host and managed data.
• Attack Vector: Remote, authenticated user (CVSS AV:N, PR:L).
• Affected Products (on-prem only):
  • Arista VeloCloud Orchestrator versions >= 5.2.0 < 5.2.3.18
  • Arista VeloCloud Orchestrator versions >= 6.1.0 < 6.1.3.10
  • Arista VeloCloud Orchestrator versions >= 6.4.0 < 6.4.2.12
• CVSS 3.1 Score: 9.9 (CRITICAL) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
• Note: Hosted and Dedicated versions of VCO were impacted but have already been patched by Arista.

Detection

• Monitor web server access logs for unusual requests containing SQL injection payloads (e.g., UNION SELECT, SLEEP(), WAITFOR DELAY, ' OR 1=1 --).
• Look for repeated authentication attempts or successful logins followed by rapid privilege escalation or access to unusual administrative endpoints.
• Analyze application logs for SQL errors or unexpected database query executions, especially from authenticated user sessions.
• Monitor for changes in user privileges or the creation of new highly privileged accounts within the VeloCloud Orchestrator.

Sigma Detection Rules

VeloCloud Orchestrator – SQL Injection Pattern in URI

title: VeloCloud Orchestrator - SQL Injection Pattern in URI
id: 9a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects common SQL injection patterns within the URI or query parameters of web requests, potentially targeting Arista VeloCloud Orchestrator.
logsource:
  category: webserver
detection:
  selection_keywords:
    cs-uri-query|contains:
      - 'union select'
      - 'sleep('
      - 'waitfor delay'
      - ''' or ''1''=''1'
      - 'information_schema'
      - 'pg_sleep('
      - 'benchmark('
      - 'xp_cmdshell'
    cs-uri-stem|contains:
      - 'union select'
      - 'sleep('
      - 'waitfor delay'
      - ''' or ''1''='
      - 'information_schema'
      - 'pg_sleep('
      - 'benchmark('
      - 'xp_cmdshell'
  condition: selection_keywords
level: high

Mitigations

1. Immediately apply available security patches from Arista. Refer to Arista Security Advisory 24838-security-advisory-0199 for specific versions.
   • For 5.2.x series, upgrade to 5.2.3.18 or later.
   • For 6.1.x series, upgrade to 6.1.3.10 or later.
   • For 6.4.x series, upgrade to 6.4.2.12 or later.
2. Implement robust input validation and parameterized queries for all user-supplied input to prevent SQL injection.
3. Enforce the principle of least privilege for all users, especially those with access to the VCO interface.
4. Regularly review and audit user accounts and their assigned privileges within the VeloCloud Orchestrator.
5. Deploy a Web Application Firewall (WAF) to help detect and block common SQL injection attack patterns.

References

• https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
• https://nvd.nist.gov/vuln/detail/CVE-2026-114625
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625

Indicators of Compromise

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1078.003 — Local Accounts
• T1133 — External Remote Services
• T1082 — System Information Discovery
• T1071 — Application Layer Protocol
• T1595.002 — Vulnerability Scanning
• T1505.003 — Web Shell
• T1548 — Abuse Elevation Control Mechanism
• T1210 — Exploitation of Remote Services
• T1098 — Account Manipulation
• T1078 — Valid Accounts
• T1068 — Exploitation for Privilege Escalation
• T1046 — Network Service Discovery