VeloCloud Orchestrator has disclosed a critical SQL injection vulnerability in on-premises VeloCloud Orchestrator (VCO) and said it is being actively exploited. The flaw, tracked as CVE-2026-114625, can allow an authenticated user with the lowest built-in tenant role to access privileged internal functionality and affect the VCO host. Arista recommends upgrading affected systems to fixed releases as soon as possible.
Key Points
- Arista disclosed a critical flaw in on-premises VeloCloud Orchestrator.
- The vulnerability is being exploited, but no specific threat actor has been publicly identified.
- Affected software includes several VCO 5.2.x, 6.1.x and 6.4.x releases.
- Arista has issued fixed versions and already patched hosted VCO services.
- Customers should restrict access, review logs and investigate suspicious activity.
The vulnerability and its exposure
Arista Security Advisory 0199 identifies CVE-2026-114625 as a CWE-89 SQL injection vulnerability affecting on-premises VCO. Arista assigns the issue a CVSS v3.1 score of 9.9 and a CVSS v4.0 score of 9.4.
Arista says the flaw may allow a remote attacker to access privileged internal functionality and affect the VCO host. Successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.
Arista states, “This issue was detected by Arista and is known to be actively exploited.” The specific threat actor or group responsible has not been publicly identified or attributed.
Exploitation requires network access to the VCO web interface and a valid authenticated session on the VCO portal. The minimum required role is Enterprise Read Only, which Arista identifies as the lowest built-in tenant role.
On an affected system, an authenticated user can gain operator privileges and masquerade as a local “superuser operator” user. This provides access to functionality intended for internal use and not intended to be remotely accessible.
Arista says VCO is exposed by default and that no configuration can prevent the exposure. Hosted VCO, including Dedicated versions, was also affected and had already been patched.
Affected versions and fixes
The affected releases are VCO 5.2.x versions before 5.2.3.18, VCO 6.1.x versions before 6.1.3.10, and VCO 6.4.x versions before 6.4.2.12. Arista says it has not assessed end-of-support software versions.
Arista lists VCO 5.2.3.18 and later in the 5.2 train, 6.1.3.10 and later in the 6.1 train, and 6.4.2.12 and later in the 6.4 train as fixed releases. The company recommends upgrading to a fixed release as soon as possible and directs customers using unsupported release trains to contact its Technical Assistance Center to discuss upgrade options.
Recommended investigation
Arista recommends reviewing VCO web access logs for unexpected activity. Investigators should look for requests containing unusual URL-like path components, encoded characters, references to local or internal services, or high request rates.
If compromise is suspected, Arista recommends preserving VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediation where operationally feasible. The company also recommends restricting access to the VCO web interface to trusted administrative networks.
Additional measures include monitoring for access from known malicious source IP addresses and unexpected outbound activity from the VCO host, considering blocks on outbound ports that are not required for normal operations, and checking for backdoor daemons and webshells. Administrators should also review recent administrator activity for unexpected changes.
Sources
About the Author
