# Arista VeloCloud Orchestrator SQLi Exploited

Published: 2026-10-28 · Severity: severe · Sectors: Telecommunications, Technology
Canonical: https://vorant.io/reports/2c4e5453-dd12-5123-8b06-61fcc60f1486/cisa-adds-arista-velocloud-flaw-to-kev
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> A critical SQL injection in Arista VeloCloud Orchestrator on-prem lets low-privilege authenticated users escalate to superuser and is being actively exploited.

Source: advisories.ncsc.nl — https://advisories.ncsc.nl/2026/ncsc-2026-0459.html

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-114625 as exploited in the wild.

NCSC-NL issued an advisory for CVE-2026-114625, a critical SQL injection vulnerability in Arista VeloCloud Orchestrator (VCO) On-Prem with a CVSS score of 9.9 (9.4 per CVSSv4). An authenticated attacker holding even the lowest-privilege role, Enterprise Read Only, can remotely exploit the flaw via the web interface to escalate privileges to a local 'superuser operator' level, gaining access to internal administrative functionality normally unreachable remotely. This can compromise confidentiality, integrity and availability of the VCO system and the network environments it manages. The vulnerable functionality is exposed by default and cannot be mitigated through configuration changes alone.

Arista has confirmed active exploitation in the wild, with malicious scanning/exploitation attempts observed from IP addresses 74.82.197[.]86 and 38.54.50[.]151. Hosted and Dedicated VCO instances have already been patched by Arista; on-premises customers must apply updates themselves. Fixes are available in VCO versions 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later within the respective release branches.

NCSC-NL and Arista urge immediate patching. Until updates are applied, access to the VCO web interface should be restricted to trusted management networks. Defenders should review web access logs for requests from the listed malicious IPs and, where compromise is suspected, preserve logs and forensic evidence for investigation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-114625 (KEV)

## Detection guidance (public sample)

### SQL Injection Keywords in Web Request Query String

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

Detects classic UNION, boolean-based and time-based SQL injection payloads in web server access log query strings, as used against internet-facing management portals such as VeloCloud Orchestrator. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Injection Keywords in Web Request Query String
description: Detects classic UNION-based, boolean-based and time-based SQL injection
  payloads (including URL-encoded forms) in the query string of web requests. Relevant
  to exploitation of SQLi flaws in public-facing management portals such as Arista
  VeloCloud Orchestrator (CVE-2026-114625). Payloads sent only in POST bodies will
  not be visible to this rule.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_union:
    cs-uri-query|contains:
    - union select
    - union+select
    - union%20select
    - union all select
    - union+all+select
    - union%20all%20select
  selection_time:
    cs-uri-query|contains:
    - pg_sleep(
    - waitfor delay
    - waitfor%20delay
    - sleep(
  selection_bool:
    cs-uri-query|contains:
    - ''' or ''1''=''1'
    - ''' or 1=1'
    - '%27%20or%20%271%27%3d%271'
    - '%27%20or%201%3d1'
  condition: 1 of selection_*
falsepositives:
- Authorised vulnerability scanners or penetration tests against the web interface
- Web applications that legitimately pass SQL-like text in search parameters
level: high
id: 1ba592f9-ccbc-5999-a10e-63b753d1e364
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0459.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: an indicator rule with Sigma, Splunk SPL, Elastic, and Suricata. A free account opens it.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0459.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/faa09ff9-8bd9-543a-b3bf-915cd48fa55a/arista-velocloud-orchestrator-sqli-exploited.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup