Arista VeloCloud Orchestrator SQL Injection Vulnerability
Arista · VeloCloud Orchestrator
Arista VeloCloud Orchestrator (VCO) on-prem contains a SQL injection flaw, classified as improper neutralization of special elements in an SQL command, that lets a remote attacker reach privileged internal functionality on the VCO host. An attacker with low-privilege authenticated access over the network, requiring no user interaction, could masquerade as the local "superuser operator" and reach internal-only functions, with potential compromise of the orchestrator's confidentiality, integrity, and availability.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 4/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) appeared 6 days after disclosure.
- Added to CISA KEVEU database agrees+1 day
- Public exploit codePoC-in-GitHub+6 days
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
3 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 3 cited passages 3Initial AccessTA0001
authenticated user escalates via valid account access
any authenticated user can gain operator privileges
remote access to internal functionality on orchestrator host
this issue may allow a remote attacker to access privileged internal functionality
Privilege EscalationTA0004
privilege escalation to superuser operator
any authenticated user can gain operator privileges
Detection
0 rules for this CVE · 236 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2026-114625 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Valid AccountsT107856 general rules
- Win Susp Computer Name Containing Samtheadmincriticaltest
- Account Created And Deleted Within A Close Time Framehightest
- Activity From Anonymous IP Addresshightest
- Atypical Travelhightest
- Azure AD Threat Intelligencehightest
- Azure Subscription Permission Elevation Via AuditLogshightest
- External Remote SMB Logon from Public IPhightest
- Impossible Travelhightest
Exploit Public-Facing ApplicationT1190149 general rules
- Arcadyan Router Exploitationscriticaltest
- Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
- Citrix Netscaler Attack CVE-2019-19781criticaltest
- Confluence Exploitation CVE-2019-3398criticaltest
- CVE-2010-5278 Exploitation Attemptcriticaltest
- CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
- CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
- CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest
Exploitation for Privilege EscalationT106831 general rules
- Exploiting CVE-2019-1388criticalstable
- Audit CVE Eventcriticaltest
- HackTool - SysmonEOP Executioncriticaltest
- InstallerFileTakeOver LPE CVE-2021-41379 File Create Eventcriticaltest
- Possible Coin Miner CPU Priority Paramcriticaltest
- Potential CVE-2021-41379 Exploitation Attemptcriticaltest
- Potential SystemNightmare Exploitation Attemptcriticaltest
- Sudo Privilege Escalation CVE-2019-14287 - Builtincriticaltest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 17 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Known_Cve | Oct 31, 2026 | Part 1/330 Oct 2026
- Actively_Exploited_Kev | Oct 31, 202630 Oct 2026
- Known_Cve | Oct 30, 2026 | Part 1/229 Oct 2026
- Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
- VeloCloud Orchestrator SQL Injection Vulnerability28 Oct 2026
- VeloCloud Orchestrator SQL Injection Vulnerability28 Oct 2026
- 11 more on OTX