CVE-2026-114625 — Arista VeloCloud Orchestrator: SQL Injection | CVSS 9.4 CRITICAL

CRITICAL

CVSS 9.4 CRITICAL  ·  EPSS 1%  ·  Arista VeloCloud Orchestrator

Severity Overview

Summary

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.

Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

What the Attack Looks Like

How it works: Attacker-controlled input is inserted into a SQL query without sanitization. The database executes the modified query, which can expose data, bypass authentication, or in some configurations execute commands on the host.

Analyst Takeaway

The attack is launched over the network (remotely exploitable without physical access) and low-privileged credentials are required. This vulnerability is already in CISA KEV, which means exploitation has been confirmed in the wild — treat this as active risk, not theoretical exposure. The CVSS score places this in critical territory, so internet-facing systems and high-value assets should be prioritized for immediate remediation or compensating controls. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.

Detection Guidance

• CWE-89 — SQL Injection
  • WAF and application logs: Search request parameters for SQL syntax: UNION SELECT, OR 1=1, -- (comment sequences), single quotes, SLEEP(, WAITFOR DELAY, BENCHMARK(, and their URL-encoded forms. Time-based blind injection may not appear in app logs but will show anomalous response latency.
  • Database error logs: A spike in query syntax errors from the application’s database user is a strong injection indicator. Legitimate traffic rarely generates SQL errors in bulk.
  • Database activity monitoring: Look for queries accessing tables outside the application’s normal working set, unexpected SELECT * across sensitive tables, or INFORMATION_SCHEMA / system catalog queries — these indicate an attacker enumerating the schema.
  • Out-of-band indicators: Successful SQL injection may cause the database server to make outbound DNS or HTTP requests (for exfiltration). Monitor for unexpected outbound connections from database hosts.

Recommended Actions

Immediate (0–24 Hours)

• Inventory: Identify all systems running Arista VeloCloud Orchestrator. Include production, staging, dev, and cloud environments — untracked instances are the most likely to remain unpatched.
• Validate internet-facing exposure: Determine which of the affected systems are reachable from the public internet. Prioritize these for immediate remediation or compensating controls.
• Apply compensating controls now: For systems that cannot be patched immediately, implement temporary mitigations: restrict access via firewall rules or ACLs, add WAF rules if applicable, disable or isolate the vulnerable component if feasible without breaking critical operations.

Remediation

• Apply the vendor patch: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• CISA directive deadline: 2026-10-26 — this is the mandatory deadline for US federal civilian agencies under BOD 22-01. All organizations should treat this date as a strong target regardless of federal mandate.
• Verify remediation: After patching, confirm the correct version is installed on all affected hosts. Run a vulnerability scan or use your asset management tooling to verify — do not rely solely on change tickets.

Detection Coverage

• Threat intelligence feeds: Monitor your TI feeds and vendor advisory channels for published indicators of compromise (IOCs), proof-of-concept exploit releases, or active campaign reporting associated with this CVE — these should trigger an immediate hunt even if no internal alerts have fired.

Detection Playbooks

Vulnerability Details

Additional Notes

https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-114625