---
title: "VeloCloud Orchestrator SQLi Zero-Day CVE-2026-114625"
url: https://erroneo.us/security/briefs/arista-velocloud-orchestrator-cve-2026-114625-sqli-zero-day/
description: "Exploited SQL injection lets any VeloCloud Orchestrator login become operator. Fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12. On-prem VCO: patch now."
type: security-brief
section: "Security Digest"
date_published: 2026-10-22
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-114625"]
severity: "critical"
exploited: "in-the-wild"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# VeloCloud Orchestrator SQLi Zero-Day CVE-2026-114625

**Verdict: Act now.** On-prem VeloCloud Orchestrator operators should upgrade today and fence off the web interface; this is the third exploited VCO zero-day since late July, and the lowest tenant role is enough to use it.

- **Who must act:** Anyone running VeloCloud Orchestrator On-Prem on the 5.2, 6.1 or 6.4 trains, especially multi-tenant orchestrators run by service providers and any VCO whose web interface is reachable from the internet.
- **Who can relax:** Customers on Arista Hosted or Dedicated VCO, which Arista has already patched; VeloCloud Edges, Gateways, EOS and other Arista products are listed as not affected.
- **Affected:** VeloCloud Orchestrator On-Prem 5.2.x before 5.2.3.18; VeloCloud Orchestrator On-Prem 6.1.x before 6.1.3.10; VeloCloud Orchestrator On-Prem 6.4.x before 6.4.2.12; End-of-support VCO releases (not assessed by Arista)
- **Fixed:** VCO 5.2.3.18 and later; VCO 6.1.3.10 and later; VCO 6.4.2.12 and later; Arista Hosted and Dedicated VCO (patched by Arista)
- **CVEs:** CVE-2026-114625
- **CISA KEV:** no · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every on-prem VCO and its exact release; anything below 5.2.3.18, 6.1.3.10 or 6.4.2.12 is exposed to an exploited bug.
2. Upgrade to 5.2.3.18 or 6.4.2.12 or later, which also carry the July and September fixes; on 6.1 or an unsupported train, upgrade and ask Arista TAC about CVE-2026-93952.
3. Restrict the VCO web interface to trusted administrative networks and block outbound ports the VCO host does not need.
4. Block 74.82.197.86 and 38.54.50.151 and search your logs for both.
5. Review recent administrator activity and remove tenant users who no longer need access.
6. If you suspect compromise, preserve web, application, system and database logs and file timestamps before upgrading, then contact Arista TAC.

### How to check if you are affected

- Search VCO web access logs for requests from 74.82.197.86 and 38.54.50.151.
- Look for requests with URL-like path components, encoded characters, references to local or internal services, or unusually high request rates from one session.
- Check for operator-level actions or configuration changes you did not make, especially ones tied to low-privilege tenant sessions.
- Watch for unexpected outbound connections from the VCO host, new daemons and webshells.

## What happened

On October 22, 2026, Arista published [Security Advisory 0199](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199) for [CVE-2026-114625](https://www.cve.org/CVERecord?id=CVE-2026-114625), an SQL injection (CWE-89) in VeloCloud Orchestrator (VCO) On-Prem. Arista found the bug itself and says it is known to be actively exploited. It scores the flaw CVSS 3.1 9.9 and CVSS 4.0 9.4.

The flaw is a privilege escalation. Any authenticated user can gain operator privileges and pose as a local "superuser operator." That opens functions meant for internal use only. Arista says it can also "affect the VCO host" and compromise the orchestrator and the data it manages. VCO is the management plane for VeloCloud SD-WAN, the product line formerly sold as VMware SD-WAN by VeloCloud, which Arista bought from Broadcom.

This is the third VCO flaw Arista has reported as exploited since late July, after CVE-2026-16812 and CVE-2026-93952 ([The Hacker News](https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html)). It is also the first of the three that needs a login. Arista has not said when the attacks started, who is behind them, or what attackers did after getting in.

## Who is affected

- **On-prem VCO** before 5.2.3.18 (5.2 train), 6.1.3.10 (6.1 train) and 6.4.2.12 (6.4 train).
- **Not listed:** the 7.0 train. Arista says versions not listed are not affected. It has not assessed end-of-support releases.
- **Hosted and Dedicated VCO** were affected, but Arista has already patched them.
- **Not affected:** VeloCloud Edges and Gateways, EOS, CloudVision, Arista Wi-Fi and the other platforms the advisory lists.

## Do you really need to act?

**Yes, if you run VCO on-prem.** The login requirement is a weak barrier. The minimum role is Enterprise Read Only, the lowest built-in tenant role. On an orchestrator a provider runs for many customers, every customer user is a possible attacker, and so is anyone holding a phished or reused password. Arista says VCO is exposed by default and that "there is no configuration that can prevent the exposure" ([SecurityWeek](https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/)).

Watch for a version trap. Upgrading after July or September does not protect you from this bug: 5.2.3.16 and 6.4.2.8 fixed the earlier flaws and are still affected. On the 6.1 train it cuts the other way. 6.1.3.10 fixes this bug, but [Advisory 0183](https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183) still lists no 6.1 fix for CVE-2026-93952, and neither advisory says whether 6.1.3.10 includes one. On the 5.2 and 6.4 trains, 5.2.3.18 and 6.4.2.12 are later than every earlier fix.

For the July and September flaws, Arista warned that a compromised orchestrator could give access to the Edge devices it manages. The new advisory does not say whether that applies here, or whether upgrading removes access an attacker already has. CISA had not added the CVE to its Known Exploited Vulnerabilities catalog as of October 23. The latest catalog is dated October 21.

## What to do now

1. List every on-prem orchestrator and its exact release. Anything below 5.2.3.18, 6.1.3.10 or 6.4.2.12 is exposed.
2. Upgrade to 5.2.3.18 or 6.4.2.12 or later. On 6.1 or an unsupported train, upgrade, and ask Arista TAC how to cover CVE-2026-93952 as well.
3. Until the upgrade is done, restrict the VCO web interface to trusted administrative networks, block outbound ports the host does not need, and block 74.82.197.86 and 38.54.50.151 ([BleepingComputer](https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/)).
4. Review recent administrator activity and remove tenant accounts that no longer need access.
5. If anything looks wrong, preserve evidence *before* patching: VCO web access logs, backend application logs, system logs, database logs and file-system timestamps. Then contact Arista TAC.

## How to tell if you were hit

Arista lists two attacker IPs and a log pattern. Search VCO web access logs for requests from 74.82.197.86 and 38.54.50.151. Also look for URL-like path components, encoded characters, references to local or internal services, and high request rates from one session. On the host, look for unexpected outbound connections, new daemons and webshells. In the application, look for operator-level changes you cannot account for, especially ones tied to low-privilege tenant sessions. A clean upgrade does not clean a host that was already compromised. If you find signs of compromise, treat the orchestrator and the Edges it manages as suspect.

## Timeline

- Jul 27, 2026 — Arista discloses exploited VCO flaw CVE-2026-16812 (Advisory 0144). CISA adds it to KEV.
- Sep 22, 2026 — Arista discloses a second exploited VCO flaw, CVE-2026-93952 (Advisory 0183), with fixes for the 5.2 and 6.4 trains only. CISA adds it to KEV.
- Oct 22, 2026 — Arista publishes Advisory 0199 for CVE-2026-114625, noting active exploitation. Hosted VCO is already patched.
- Oct 23, 2026 — Not in CISA KEV (catalog version 2026.10.21).

## Sources

1. [Arista — Security Advisory 0199 (CVE-2026-114625)](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)
2. [CVE record — CVE-2026-114625](https://www.cve.org/CVERecord?id=CVE-2026-114625)
3. [Arista — Security Advisory 0183 (CVE-2026-93952)](https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183)
4. [The Hacker News — Arista warns of critical VeloCloud SQL injection zero-day exploited in attacks](https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html)
5. [SecurityWeek — Attackers exploit third VeloCloud Orchestrator zero-day in four months](https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/)
6. [BleepingComputer — Arista patches new VeloCloud Orchestrator zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/)

---
Source page: https://erroneo.us/security/briefs/arista-velocloud-orchestrator-cve-2026-114625-sqli-zero-day/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt