Arista VeloCloud: SQL Injection CVE-2026-114625 Scores CVSS 9.9, CISA Deadline October 26

Arista Networks disclosed CVE-2026-114625, a critical SQL injection in VeloCloud Orchestrator On-Prem rated CVSS 9.9. CISA added it to the KEV catalog on October 23, 2026, giving federal agencies a three-day remediation deadline of October 26.

Arista Networks published Security Advisory 0199 on October 22, 2026, for CVE-2026-114625, a SQL injection vulnerability in VeloCloud Orchestrator On-Prem that earned the highest possible score for a flaw requiring authentication: CVSS 9.9 on the 3.1 scale. CISA added it to the Known Exploited Vulnerabilities catalog on October 23, imposing a remediation deadline of October 26, 2026, on U.S. federal agencies. The gap between disclosure and deadline: three days.

Key Takeaways

Any authenticated user with the minimal Enterprise Read Only role can escalate to superuser operator by manipulating internal SQL queries
The VeloCloud Orchestrator is exposed by default and no configuration can prevent the exposure, per the Arista advisory
Fixed builds are 5.2.3.18, 6.1.3.10, and 6.4.2.12; VeloCloud Gateway and Edge are not affected
CISA published two indicators of compromise: IP addresses 74.82.197.86 and 38.54.50.151

The Mechanism: From Enterprise Read Only to Superuser Operator

The vulnerability, classified as CWE-89 (SQL injection) with internal bug ID BUG2043622, resides in a web application of the SD-WAN management panel. It requires no elevated privileges to exploit: the Arista advisory specifies that "any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user." The vector is network-based (AV:N), attack complexity is low (AC:L), requires an authenticated session with limited privileges (PR:L), no user interaction (UI:N), and impact propagates beyond the immediate target (S:C) with maximum effects on confidentiality, integrity, and availability (C:H/I:H/A:H). The CVSS 4.0 score confirms severity at 9.4, per the CVE.org record. The 9.9 score on the 3.1 scale represents the maximum technically achievable when the authentication requirement prevents a 10.0, as noted in analyses by Shattered and Rescana. The full vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Active Exploitation and Published Indicators

Arista confirmed the flaw "is known to be actively exploited." CISA, in the KEV entry, justified inclusion "based on evidence of active exploitation." The government catalog requires U.S. federal agencies to comply with Binding Operational Directive 26-04, which mandates both patching by the deadline and a forensic triage to check for pre-patch compromise. Two indicators of compromise associated with the malicious activity have been published: IP addresses 74.82.197.86 and 38.54.50.151. No attribution to specific threat actors emerges from the collected material. The effective start date of the attack campaign is not specified by Arista.

"any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user" — Arista Security Advisory 0199

Fixed Builds and Risk Perimeter

Fixed versions are 5.2.3.18, 6.1.3.10, and 6.4.2.12 for their respective trains. Train 7.0 is not mentioned as vulnerable in the dossier. VeloCloud Gateway and Edge are explicitly excluded from the risk perimeter. For Hosted and Dedicated instances, Arista has already applied fixes on the provider side. An operational friction point emerges from the overlap between advisories: the same fixed builds for CVE-2026-114625 appear in Security Advisory 0201 for a separate security issue. Operators must sequentially manage vulnerabilities with distinct effects without being able to distinguish them by version.

The Pattern: Third VCO in 2026

CVE-2026-114625 is the third vulnerability in VeloCloud Orchestrator reported as exploited in 2026, following CVE-2026-16812 (July) and CVE-2026-93952 (September). The frequency raises questions about the security posture of the SD-WAN management layer, a critical element for enterprises' distributed network infrastructure. The Enterprise Read Only role, typically assigned to tenant users, customers, or MSP partners for audit and monitoring, becomes in this context a bridge to total control of the orchestrator. The privilege structure in VeloCloud's multi-tenant architecture demands a re-evaluation of shared access practices.

Immediate Actions

Arista lists the following priority actions for operators with on-prem instances: 1. Update immediately to fixed builds: 5.2.3.18 for the 5.2 train, 6.1.3.10 for the 6.1 train, 6.4.2.12 for the 6.4 train. Previous versions, including those patched for prior CVEs, do not protect against this flaw. 2. Conduct forensic triage on systems: verify the presence of indicators of compromise 74.82.197.86 and 38.54.50.151 in access logs and connections to the VCO. CISA explicitly requires this check for BOD 26-04. 3. Review accounts with read-only privileges: audit active Enterprise Read Only sessions, checking for privilege escalation anomalies or unauthorized access to administrative functions. 4. Monitor subsequent advisories: the same builds also fix other security issues; operators must verify patch coverage completeness for their train.

Editorial Close

The three-day window between disclosure and the CISA deadline is among the tightest in 2026 for a vulnerability of this severity. The combination of confirmed exploitation, maximum CVSS impact, and absence of configurable mitigations makes CVE-2026-114625 a mandatory, immediate patching event for every organization running VeloCloud Orchestrator On-Prem. The frequency of exploited VCO flaws this year suggests the SD-WAN management perimeter warrants a strategic reassessment of access controls and update cycles.

Sources

Sources and references

Get DeafLetter