Arista confirmed VeloCloud SQLi is exploited. Last month’s floor is still in.

Security Advisory 0199, 22 October, is CVE-2026-114625 (CVSS 9.9). Enterprise Read Only is enough to become local superuser operator. Hosted is patched. On-prem needs 5.2.3.18 / 6.1.3.10 / 6.4.2.12. 5.2.3.16 closed September’s 93952, not this. Two IPs. Catalog 2026.10.21 still 1754.

RWP Ventures · 2026-10-23 · event 2026-10-22 · 13 min read · priority 9.1

Do not collapse five facts.

1. This is not yesterday’s PHP2Shell and it is not Friday’s Plex clock. [PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35](/posts/2026-10-22-php2shell-cve-2026-109618-109619/) closed interpreter RCE. [Plex CVE-2026-96656 / 96654](/posts/2026-10-21-plex2shell-kev-assume-compromise/) are due today on KEV. VCO is the SD-WAN orchestrator. A CMS or media-server ticket does not change it.
2. Last month’s floor is still in. September’s exploited VCO bug was CVE-2026-93952, closed on-prem at 5.2.3.16 and 6.4.2.8. This bug’s floors are 5.2.3.18, 6.1.3.10, and 6.4.2.12. A host that took the September emergency build is still affected. July’s CVE-2026-16812 is a third, older row. Neither of those two required a login. This one does.
3. Enterprise Read Only is enough. Exploitation needs network access to the VCO web interface and a valid portal session. The minimum built-in tenant role is Enterprise Read Only. Arista: VCO is exposed by default and there is no configuration that can prevent the exposure. Restricting the UI to an admin network is a network control, not a VCO toggle that closes CWE-89.
4. Hosted is not the on-prem ticket. Arista says Hosted, including Dedicated, VCO were impacted and have already been patched. On-prem still has to move. VeloCloud Gateway and Edge are not affected. EOS switches are not affected. If the release is not on the affected list, Arista says the deployment is not vulnerable — including 7.0, which is not listed. End-of-support trains have not been assessed.
5. This is not a PLC event. VCO is an SD-WAN management plane. A hit can change WAN policy and, on this CVE, Arista says it may impact the VCO host. That is not confirmed OT process impact. Do not merge it with Siemens Software Center, Danfoss, or a plant historian.

CISA’s Known Exploited Vulnerabilities catalog this morning is still 2026.10.21 / 1754, dateReleased 2026-10-21T14:04:39Z. Newest rows remain the 20 October six (Plex, SiteGuard, Siemens). CVE-2026-114625 is not on it. Neither is PHP2Shell. There is no BOD 26-04 due date for this CVE.

The operator sentence: inventory every on-prem VCO by the four-part build, treat 5.2.3.16 / 6.4.2.8 as still in, hunt the two IPs and the web logs before you upgrade, and do not close the ticket because Hosted is green.

What happened

Arista shipped SA-0199 on 22 October 2026, revision 1.0. CVE.org and NVD published CVE-2026-114625 the same calendar day. Affected on-prem trains, from the CNA record:

On an affected system, any authenticated user can gain operator privileges and masquerade as a local “superuser operator.” That role reaches functionality Arista says is intended for internal use only and not intended to be remotely accessible. Successful exploitation may compromise confidentiality, integrity, and availability of the orchestrator and the data it manages, and may impact the VCO host.

Arista published two source addresses observed conducting the attacks:

• 74.82.197.86
• 38.54.50.151

Hunt the VCO web access logs for those IPs and for requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates. Absence of the two IPs does not prove the box is clean. Infrastructure rotates.

If compromise is suspected, Arista’s order is evidence first: preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible. Then call TAC.

This is the third VCO issue Arista has described as exploited since late July:

The September floor is the operational trap. A change record that says “VCO patched after 93952” is still open. SA-0183’s 6.1 gap is a second trap: 6.1.3.10 is this CVE’s listed fix. Neither advisory we have says whether 6.1.3.10 also closes 93952. Treat 6.1 as two questions, not one version string.

Catalog check this morning: version 2026.10.21, count 1754. No 114625 row. No PHP 109618 / 109619 row. Plex 96654 / 96656 and SiteGuard 106931 are due today. Those clocks did not pause because Arista published.

Why it matters

VCO is the control plane for VeloCloud SD-WAN — the portal that configures, monitors, and manages edges. Arista acquired the line from Broadcom (formerly VMware SD-WAN by VeloCloud). In that model, operators create customer and partner accounts; partners manage groups of customers. Superuser operator is the top of that tree.

Three operational reasons this is the daily.

First, the privilege bar is a tenant login, not an admin login. A stolen, sprayed, or leftover Enterprise Read Only session is in scope. Scope is Changed on the v3.1 vector. This is not “an admin clicked a bad query.” It is “a low tenant role reaches internal-only functions and may hit the host.”

Second, the last two emergency builds are not this close. July and September were pre-auth VCO 0-days. This one is authenticated. Teams that burned a change window on 5.2.3.16 or 6.4.2.8 will show “patched VCO” in the CMDB. They are not. Hosted being green is a second false close for anyone who also runs on-prem.

Third, the remaining clock is not KEV. FCEB agencies do not have a BOD 26-04 due date. Arista already says it is exploited. Do not wait for a catalog row to inventory on-prem VCO, restrict the UI, and hunt the two IPs.

Who / what is affected

• On-prem VeloCloud Orchestrator (formerly VeloCloud Orchestrator by Broadcom) on 5.2 before 5.2.3.18, 6.1 before 6.1.3.10, 6.4 before 6.4.2.12.
• Hosted and Dedicated VCO: were affected; Arista says they have already been patched. Confirm the tenant is on the vendor’s patched service. Do not skip the log hunt because the SaaS box moved.
• Not affected (vendor): VeloCloud Gateway, VeloCloud Edge, and the long EOS / CloudVision / NG Firewall list in SA-0199. Do not open a switch or edge-firmware ticket for this CVE.
• 7.0 train: not on the affected list. Arista: if the release is not listed, the deployment is not vulnerable. Do not invent 7.0 as in-scope.
• End-of-support trains: not assessed. TAC for upgrade options. Do not treat “EOL, no CVE row” as safe.
• Prerequisite: network path to the VCO web interface and a valid authenticated portal session. Minimum role: Enterprise Read Only. No VCO setting removes the exposure.
• OT / ICS: UNKNOWN for process impact. An SD-WAN that carries plant traffic is still an IT/network compromise until evidence says otherwise. Do not merge this with Siemens SSC CVE-2026-110936 or CISA’s 22 October ICS batch.

Technical context

High-level, from SA-0199 and the CVE record. This is not an exploit recipe.

The weakness class is CWE-89 (SQL injection). Arista does not publish the parameter, the endpoint, or a proof of concept in the advisory we are using. Public secondary reporting describes low-complexity SQLi without user interaction, given a session. We are not reconstructing the query.

What the vendor did specify:

• Reachability: VCO web interface, exposed by default.
• Identity: any authenticated portal user, down to Enterprise Read Only.
• Effect: operator privileges; masquerade as local superuser operator; access to internal-only functionality; possible impact to the VCO host and to orchestrator data.
• Scope: CVSS v3.1 S:C — impact is scored beyond the vulnerable component.

ATT&CK (defensive mapping, not attribution): T1190 exploit public-facing application; T1078 valid accounts; T1068 exploitation for privilege escalation. Follow-on webshells, backdoor daemons, and unexpected outbound from the VCO host are what Arista told operators to monitor, not a confirmed payload set. Actor identity: UNKNOWN. Ransomware use: UNKNOWN. Named victim list: UNKNOWN. When exploitation started: UNKNOWN.

July and September VCO advisories warned that a compromised orchestrator could grant access to Edge devices. SA-0199 does not repeat that sentence for 114625. Do not assert Edge takeover from this CVE. Do not assume an upgrade evicts an operator who already became superuser — preserve logs, review admin activity, then rebuild or re-credential on the fixed train.

Threat / exploitation status

What defenders should do

1. Inventory on-prem VCO by train and four-part build, not “we use Arista SD-WAN” and not “Hosted is patched.” 5.2.x below 5.2.3.18, 6.1.x below 6.1.3.10, 6.4.x below 6.4.2.12 are in. Confirm Hosted/Dedicated tenants against Arista’s patched service, then still hunt logs.
2. Upgrade on-prem to the floor for that train. 5.2.3.18, 6.1.3.10, 6.4.2.12 or later. Unsupported trains: TAC. Do not stop at 5.2.3.16 or 6.4.2.8.
3. Until the build is in: restrict the VCO web interface to trusted administrative networks; monitor for the two IPs; watch unexpected outbound from the VCO host; consider blocking outbound ports the orchestrator does not need; monitor for backdoor daemons and webshells; review recent administrator activity for unexpected changes. Those are buffers. They do not close CWE-89.
4. Hunt before you declare clean. Block and search 74.82.197.86 and 38.54.50.151. Review VCO web access logs for encoded path components, URL-like paths, internal-service references, and high request rates. A miss on the two IPs is not a miss on the class.
5. If you suspect a hit, preserve first. Web access, backend app, system, database, file-system timestamps — then remediate. A patched version string does not revoke a superuser session that was already minted. Rotate portal credentials, review operator/partner accounts, and treat unexpected admin changes as incident work.
6. Do not wait for KEV. Catalog is still 1754. The federal clock has not started. The on-prem clock started when SA-0199 did.
7. Do not close adjacent tickets on this CVE. Gateway and Edge are out of scope for 114625. PHP2Shell is the interpreter. Plex 96656 forensic triage is due today. SiteGuard 106931 is due today. Sequence them; do not merge them.

RWP is not publishing exploit SQL, parameter names, or a how-to for the injection.

RWP assessment

High confidence that CVE-2026-114625 is authenticated SQL injection in on-prem VCO, that Arista rates it 9.9/9.4 with Scope Changed, that Enterprise Read Only is the published minimum role, that Hosted/Dedicated are vendor-patched, that the on-prem floors are 5.2.3.18 / 6.1.3.10 / 6.4.2.12, and that the CVE is not on KEV catalog 2026.10.21 / 1754.

High confidence that 5.2.3.16 and 6.4.2.8 do not close this CVE.

High confidence in vendor-confirmed exploitation as of 22 October. That is Arista’s statement, not a third-party victim census.

Moderate confidence that this is the third exploited VCO issue since July and the first of that trio that requires a login — the auth bar is in SA-0199; the pre-auth character of 16812 / 93952 is from those earlier public advisories, not re-proven in today’s retrieval.

Low confidence in actor identity, dwell, payload, and ransomware overlay. None is in SA-0199.

Confidence that this is not OT process impact: high. No evidence in this retrieval that a controller, safety system, or physical process was affected. An SD-WAN carrying industrial traffic is still an IT/network finding until someone shows process change.

This outranked the rest of the window because it is a new, vendor-confirmed, actively exploited SD-WAN control-plane CVE published 22 October, after yesterday’s PHP2Shell daily. The September VCO floor is a built-in false close. PHP2Shell had no KEV increment overnight (still 1754). Plex’s Friday due date is already the 21 October Daily Top. Microsoft’s Storm-0940 / ARTEX write-up is a material attribution increment on ConnectWise, which this desk already ran 17–19 October. GitLab’s second CVSS 10 regex bug and Fortinet’s CVE-less 22 October hardening train are real work, not exploited-today control-plane 0-days.

What we are watching

• Whether CISA adds CVE-2026-114625 to KEV, and whether BOD 26-04 forensic triage is Yes.
• Whether 6.1.3.10 is also the missing CVE-2026-93952 floor, or 6.1 still waits on September.
• A named victim, a payload beyond “possible host impact,” or Edge-device follow-on stated for this CVE.
• [Plex 96654 / 96656](/posts/2026-10-21-plex2shell-kev-assume-compromise/) and SiteGuard CVE-2026-106931, due today. Not this product.
• [PHP2Shell 109618 / 109619](/posts/2026-10-22-php2shell-cve-2026-109618-109619/) still off KEV.
• Microsoft Storm-0940 / ARTEX on ConnectWise Cloud Backup — attribution and 2,250-tenant attempt count; not a new CVE.
• Fortinet 22 October FortiOS / FortiManager / FortiAnalyzer hardening builds; public CVEs promised 10 November. No exploitation claimed in the CISO note.
• GitLab CVE-2026-110264 (unauthenticated regex compiler RCE, CVSS 10, self-managed CE/EE from 7.0). No confirmed in-the-wild use in this retrieval.

Sources

Primary: Arista Security Advisory 0199 (22 October 2026); CVE-2026-114625 (Arista CNA); NVD CVE-2026-114625; CISA KEV JSON catalog 2026.10.21 / 1754. Independent: BleepingComputer 22 October; The Hacker News 22 October (train table vs 93952 floors). Background: Arista SA-0183 / CVE-2026-93952; CISA 20 October six-row KEV alert. Adjacent, not this story: PHP 21 October advisory; Microsoft Storm-0940 post 21 October; Fortinet CISO Collective 21 October. Prior RWP: PHP2Shell Daily Top 22 October; Plex2Shell Daily Top 21 October; weekly IT 28 September (93952).