DEV Community

Anoymask
Anoymask

Posted on Edited on

Arista VeloCloud On-Prem CVE-2026-114625: Actively Exploited SQL Injection Enables Operator Privilege Escalation

#security #threatintel

1. Basic Information

2. Executive Summary

A vulnerability in on-premises VeloCloud Orchestrator (VCO) allows authenticated low-privilege users to leverage a SQL injection to reach internal functions and spoof a local superuser operator. Arista has confirmed active exploitation in the wild and published two attacker IP addresses. CISA added the vulnerability to its KEV catalog on October 23, 2026, with a due date of October 26, 2026.

Key Updates as of October 25

  • Following its addition to CISA KEV, public confirmation of active exploitation and a short remediation window have been established. Organizations running on-premises VCO should verify external exposure and the presence of low-privilege accounts, prioritizing patch application and log review.

3. Attack Flow

Attack and Exploitation Chain Reconstructed from Public Information

  1. The attacker prepares a valid low-privilege VCO portal session (Enterprise Read Only or higher).
  2. They send a crafted HTTP request to the web management interface, exploiting input validation flaws to trigger a SQL injection.
  3. They reach internal functions that are normally not publicly accessible via remote access, escalating and spoofing privileges as a local superuser operator.
  4. Once privilege escalation is successful, the VCO host and management data may be impacted (specific subsequent configuration changes or persistence mechanisms have not been publicly disclosed at this time).

The table below organizes the public information above, with indicators serving as candidate items for internal investigation (Inference). Specific implementations or subsequent actions that remain private are not inferred.

Attack Stage Attacker Action / Technique Tools / Communications Defender Indicators (Prerequisites / Artifacts)
1. Session Establishment Obtain and prepare a valid low-privilege tenant account session (Enterprise Read Only or higher) Connection to VCO web portal (verify configuration for listening ports) Unusual tenant account logins, verification of source IP addresses
2. Vulnerability Exploitation Send a crafted HTTP request to the web management interface to execute SQL injection Crafted HTTP request (specific request format not publicly disclosed) Abnormal URL paths in web access logs, encoded characters, high-frequency requests, public IOCs (74.82.197.86, 38.54.50.151)
3. Privilege Escalation Access internal services and elevate/spoof privileges to local superuser operator Access to internal functions (specific API/database operations not disclosed) Internal service access from low-privilege sessions, unauthorized operator actions
4. Impact Expansion (Potential) Impacting the VCO host and management data Specific subsequent operations not disclosed Unauthorized operator action logs, SD-WAN configuration changes, suspicious outbound host communications

4. Attacker Location and Execution Context

  • A remote attacker who has network reachability to the VCO web interface and holds a valid low-privilege tenant session.

5. Victim and Administrator Perspective

Victims

  • From a general user perspective, the session appears as a normal portal session, while administrative privileges and settings may be improperly altered.

Administrators and SOC

  • Observed as abnormal URL paths in web access logs, encoded strings, suspicious references to internal services, sudden spikes in request rates, and unexpected administrator action history.

6. Success and Failure Conditions

Success Conditions

  • Running an unpatched version within the affected 5.2.x, 6.1.x, or 6.4.x series (End-of-life versions have not been evaluated and are not assumed unaffected).
  • Reachability to the VCO web interface and possession of a valid session with Enterprise Read Only permissions or higher.

Failure Conditions and Mitigations

  • Immediately update to 5.2.3.18, 6.1.3.10, or 6.4.2.12 depending on the running series, and consult Arista TAC for migration options on unsupported series.
  • Until updates are complete, restrict access to the management interface strictly to trusted management networks (blocking public IOCs or rotating credentials alone does not remediate the underlying vulnerability).

7. What Happens Upon Success

  • Unauthorized acquisition of superuser operator privileges.
  • Compromise of the confidentiality, integrity, and availability of the VCO host and data managed by the VCO.
  • Potential unauthorized modification of configurations, persistence (backdoor installation), and expansion of compromise to the SD-WAN management plane.

8. Observable Logs

Inference: The items below are candidates for internal investigation. Feasibility depends on products, permissions, configurations, and log retention periods, and is distinct from observed facts in intelligence sources. A single event alone does not confirm attribution or successful compromise in this case.

Email

  • No email-origin attack vectors specific to this issue have been publicly disclosed.

Proxy / SWG / DNS

  • Check VCO web access logs for published attacker IPs (74.82.197.86, 38.54.50.151), abnormal URL paths, encoded characters, internal service references, and short-burst high-frequency requests.

Endpoint / EDR

  • Preserve VCO backend, system, and database logs as well as file update timestamps within supported scopes, and investigate for configuration changes or abnormal processes (EDR deployment is not assumed).

Identity / IdP

  • Correlate VCO tenant authentication sessions with assigned roles, operator action history, and account modification history in chronological order.

SaaS / Cloud

  • Hosted and Dedicated VCO are reported patched by the provider. Inspect management settings and API usage history for on-premises environments as far as obtainable.

Network

  • Track external connections to the VCO web interface and subsequent unusual outbound traffic or internal connections from the host in chronological order.

9. Determining Attack Success

Confirmed in Public Information

Arista has confirmed actual exploitation and two attacker IP addresses. However, the exact success stages and full details of post-compromise activities within individual victim organizations remain undisclosed.

Criteria for Internal Assessment

  • Attack Attempt Observed (Success Unconfirmed): Mere matching of public IOCs or receipt of anomalous requests does not confirm that privilege escalation succeeded in an individual operating environment. Review authentication sessions and request contents in detail.
  • Subsequent Compromise Confirmed: Refers to stages objectively supported by evidence such as unauthorized operator actions, modified privileges/settings, or host file alterations (matching public IOCs alone does not constitute this stage).

10. Investigation Playbook

  • Trigger: Detection of vulnerable versions running, matching public IOCs, anomalous URL paths, or unexpected assignment of operator privileges.
  • Initial Review: Verify running versions, external exposure status, active sessions, assigned roles, web access logs, and administrator action history.
  • Endpoint / Server Investigation: Preserve and investigate running processes, webshell artifacts, daemon configurations, file timestamps, and backend logs on the VCO host.
  • Identity / Cloud Investigation: Check tenant accounts, session information, operator roles, credential change history, and API token usage.
  • Subsequent Operations: Track SD-WAN configuration changes, internal service access, suspicious outbound traffic (egress), persistence configurations, and data access.
  • Containment: Apply software patches, restrict reachability to the management plane, invalidate suspicious sessions, rotate credentials, and rebuild systems if necessary.
  • Assessment Categories: Clearly distinguish between contact, execution, authentication success, information retrieval, and subsequent compromise, avoiding success determinations lacking objective evidence.

11. Defense and Detection Ideas

  • Single Events: Immediately detect access from public IOCs, requests containing anomalous paths or encoded strings, and unauthorized privilege spoofing to superuser operator.
  • Chronological Correlation: Correlate the sequence of low-privilege login -> generation of anomalous requests -> privilege escalation to operator -> configuration changes -> host outbound communications.
  • Threat Hunting: Cross-search historical VCO web, backend, database, and system logs for the two published IPs, anomalous paths, and internal service references.
  • Log Limitations: Because Arista has not published a complete signature for exploit requests, relying solely on IOCs is insufficient.
  • Prioritized Mitigations: Prioritize immediate updates to patched versions, restricting management interface accessibility, strengthening session protection, enforcing least privilege, and long-term log retention.

12. Facts / Inference / Hypothesis

Facts

  • Arista has disclosed that CVE-2026-114625 is being actively exploited in attacks.
  • Exploitation is possible if an attacker has reachability to the VCO web interface and a valid session including the lowest built-in tenant role (Enterprise Read Only or higher).
  • SQL injection allows attackers to acquire operator privileges, spoof a local superuser operator, and access internal features that are normally not publicly accessible.
  • 74.82.197.86 and 38.54.50.151 have been observed as attacker source IPs.
  • Versions prior to 5.2.3.18 in the 5.2.x series, prior to 6.1.3.10 in the 6.1.x series, and prior to 6.4.2.12 in the 6.4.x series are affected. Patches are available for each respective series, and Hosted/Dedicated VCO instances are already patched (end-of-life versions are unevaluated).
  • CISA added CVE-2026-114625 to its KEV catalog on October 23, 2026, with a remediation due date of October 26, 2026.

Inference

  • Compromised or low-privilege tenant accounts may serve as initial entry points, potentially leading from management plane compromise to modified SD-WAN configurations or access to internal secrets.

Hypothesis

No additional hypotheses. Unverified items are documented under "Unresolved Questions and Further Investigation."

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high SQL injection against the VCO web interface confirmed exploited by Arista; requires network reachability and a valid authenticated session.
T1068 Exploitation for Privilege Escalation high A flaw allowing escalation to operator privileges from an authenticated session including the lowest built-in tenant role.

14. Unresolved Questions and Further Investigation

  • Specific threat actors, the number of compromised organizations, the initial credential acquisition vectors, and detailed post-compromise activities have not been publicly disclosed at this time.

15. Impact on SOCs and Organizations

Administrators operating on-premises VCO environments should immediately verify their running version, apply patches, and review historical logs for public IOCs, anomalous URL paths, encoded strings, internal service references, and administrator modification history.

16. Summary by Target Audience

  • For SOCs: Monitor and correlate public IPs, anomalous URL paths, backend/database logs, administrator action history, outbound communications from the VCO host, and webshell artifacts.
  • For Administrators: Immediately update VCO to the patched version for your series, restrict access to the management interface to trusted networks, and check for suspicious sessions, accounts, or configuration changes.
  • For End Users: No direct actions are required, but promptly follow any instructions from administrators regarding credential changes or other guidance.

Top comments (0)