A read-only VCO login reached operator superuser through one SQL fragment

If you run on-prem Arista VeloCloud Orchestrator, your patch deadline is today. CISA added CVE-2026-114625 to KEV on October 23, 2026, with a federal deadline of October 26. The bug is a SQL injection that lets a read-only customer account walk out of the orchestrator as a local operator superuser.

Arista published Security Advisory 0199 on October 22, telling customers the issue was already exploited in the wild. The orchestrator sits on the SD-WAN management plane, so a single compromised operator pushes config and update bundles to every connected edge. Attackers reached that role from a login whose only legitimate function is to read dashboards.

What the SELECT actually did

The flaw sits in an internal API the VCO web interface calls while the user is already authenticated. Arista's advisory describes it as a SQL injection reaching privileged internal functionality, scored CVSS 9.9 under v3.1 and 9.4 under v4.0, internal bug ID BUG2043622, CWE-89. The code takes a value from the signed-in session and concatenates it directly into a query against operator records, so a crafted field changes the SQL the database runs rather than what it returns. The ordinary SQLi primitive, left exposed on a code path only trusted roles should ever reach.

Once the statement is yours to shape, grafting a UNION or stacked write onto a legitimate query is the obvious step, and public write-ups say the outcome is impersonation of a local operator superuser, the role from which VCO pushes config, uploads update bundles, and manages tenants. A straight privilege boundary, from dashboard reader to platform administrator, through a parameter the application was quietly concatenating. Aviatrix reports crafted SQL payloads arriving at the web interface from two tracked IP addresses, which lines up with Arista observing active abuse before the advisory went out.

A read-only badge that was never meant to touch SELECTs

Role-based access on an orchestrator works through a request filter in front of the handlers: the filter asks whether this session can call this endpoint and hands control to the handler, which then trusts whatever data the request supplied. That design works until a parameter changes the shape of the SQL below the handler. At that moment the policy no longer describes what the request can do, because the request is now writing its own query. The role check still passes and the database still runs the statement, because neither layer sees the other.

CVE-2026-114625 fits that shape. The attacker needs network access to the VCO web interface, which is on by default, and any session at Enterprise Read Only or above. Of the three VCO flaws exploited in the wild since July 2026, this is the first to require authentication at all; the two before it, both CVSS 10.0, were unauthenticated OS command injections. Authentication here feels like a mitigation until you remember Read Only logins end up in password managers, support playbooks, and shared MSP tooling.

The gap a CVSS 9.9 queue still manages to hide

A CVSS 9.9 lands near the top of any numeric queue, so most teams will see this one today. The problem is what the number does not tell you: the vulnerable path is reachable only from inside the authenticated web app, the minimum role is Enterprise Read Only, and the exposure depends on whether your VCO is on the internet or behind a jump host on an isolated management VLAN. Two shops running the same fixed version live under very different risk when one puts the orchestrator behind a bastion and the other serves it on a public IP with Enterprise Read Only accounts in a help-desk shared vault. A CVSS-first queue cannot see that difference.

The second gap is slower. Scanners that key off NVD will carry an entry for CVE-2026-114625, but the exploitation evidence that pulled it into KEV came from Arista's telemetry and third-party incident response, not a signature. Reporting on the Arista advisory says attack logs look like a normal session making unusual requests, so hunting signal lives in path components, encoded characters, and request rates. A detection stack tuned to failed logins and known exploit strings leaves this one in the quiet lane.

How TRIS routed this past the queue

TRIS, the Threat and Risk Intelligence Scoring engine inside CVEasy AI, scores a finding across the layers that decide whether a CVE should move your week. For CVE-2026-114625 the layers walk like this.

Active exploitation. Arista's advisory confirms exploitation in the wild and CISA added the CVE to KEV on October 23 with a federal deadline of October 26. A proven PoC is not the same as confirmed in-the-wild abuse, but the vendor is reporting observed attacks, which pushes this layer to its top band on exposed instances.

Blast radius against the asset. VCO sits on the SD-WAN management plane, so compromising it gives an attacker a legitimate channel into every connected edge. Enterprise and MSP tenants running VCO on-prem sit in the same category as a stolen Kubernetes control plane: one asset, broad reach.

Local exposure. Here the same CVE scores two very different numbers in TRIS. A VCO reachable only on an internal management VLAN, with Enterprise Read Only accounts behind SSO and MFA, scores lower than one listening on a public IP with those accounts in a help-desk shared vault. TRIS reads the actual network position of each orchestrator and the roster of accounts that can hit the vulnerable endpoint.

Patch window. Arista shipped 5.2.3.18, 6.1.3.10, and 6.4.2.12 on October 22, and cloud Hosted and Dedicated orchestrators were patched by Arista directly. TRIS lowers this layer where a fix exists and raises it where none does.

Add the layers and the finding is top band for any customer running an exposed on-prem VCO today, and settles lower on an orchestrator behind a bastion with per-role MFA. That is the point of a CTEM loop: the inventory decides the score.

Fixed builds, rotation list, and the log signal nobody drops

1. Apply the Arista fixed builds today. 5.2.3.18 on 5.2.x, 6.1.3.10 on 6.1.x, and 6.4.2.12 on 6.4.x per Arista SA 0199. Cloud Hosted and Dedicated orchestrators are already patched by Arista. If a maintenance window pushes patching past the deadline, pull the web interface off the public internet and gate it behind a jump host with SSO and MFA for every account, including Enterprise Read Only.

2. Rotate the roles the bug can reach. Assume credential exposure anywhere a VCO was internet-reachable in the exploitation window. Rotate every orchestrator account active in that period, including Enterprise Read Only logins, and anything the operator role touches downstream: shared SSH keys for edge appliances, API tokens issued from the orchestrator for integrations, and any update bundle signing material that transited the orchestrator.

3. Hunt in session shape, not login failures. Review audit logs for sessions that look like a normal customer user but hit paths they do not usually touch, with encoded characters in parameters or request rates outside human pacing. Aviatrix published two attacker IPs as a starting point; the durable signal is in the request shape.

4. Verify the edges the orchestrator can push to. Diff running config on each edge against the last known-good config, verify recent update bundles against Arista's published hashes, and flag anything applied from the orchestrator during the window for manual review.

How CVEasy AI surfaces this

CVEasy AI, the number one local-first CTEM platform, ingests the raw sources an on-call analyst actually reads: vendor PSIRT feeds, CISA KEV, and the research write-ups that follow. For CVE-2026-114625 the Arista advisory, the KEV listing, and the exploitation observations from Aviatrix and others are in the queue by the time your coffee is cold. TRIS runs those feeds against the inventory on your own hardware, so the finding reaches the morning view as a specific instruction on your specific orchestrators rather than a generic nine point nine badge. Version, network position, account roster, and audit log paths stay on your hardware; the answer that comes back is the one that decides your week.

On-prem management planes are tempting targets, and the ones a scanner marks compliant are the same ones that give an authenticated attacker a clean lane into the control plane. CVE-2026-114625 is the fresh instance of a very old pattern.

Sources: Arista SA 0199, CISA KEV, Aviatrix, Security Online, The Hacker News, Canadian Centre for Cyber Security AV26-1080