Critical SQL Injection in Arista VeloCloud Orchestrator (CVE‑2026‑114625) Enables Privilege Escalation
What It Is – A critical SQL‑Injection flaw (CVSS 9.4) in the on‑premises VeloCloud Orchestrator (VCO) allows any authenticated user – even a read‑only account – to obtain operator privileges and impersonate the local super‑user.
Exploitability – The vulnerability is actively exploited; CISA has listed it in the Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is required beyond a valid login.
Affected Products – Arista VeloCloud Orchestrator (on‑premises) – the central management component for VMware/Arista SD‑WAN deployments. Hosted VCO versions have been patched.
Why It Matters for Trust & Control Assurance
- Access‑Control Assurance – The flaw bypasses least‑privilege design, exposing a control gap that spans multiple frameworks (e.g., NIST CSF 2.0 “Protect” function).
- Audit‑Ready Evidence – Successful exploitation would leave traces in web, application, and database logs; capturing and correlating these logs is essential for a defensible audit trail.
- Continuous Monitoring Requirement – Detecting anomalous privileged activity demands real‑time log aggregation and alerting, a core component of a trustworthy control‑monitoring program.
Recommended Actions
- Patch Immediately – Apply Arista’s latest VCO security update.
- Enforce MFA & Strong Passwords for all VCO accounts, especially low‑privilege roles.
- Review and Harden Role Assignments – Ensure the principle of least privilege; remove unnecessary read‑only accounts.
- Enable Comprehensive Logging – Capture web‑interface, application, system, and database logs; forward them to a SIEM for continuous analysis.
- Monitor for Indicators of Compromise – Look for encoded SQL payloads, high request rates, or access from the IPs listed by CISA.
Source: Security Affairs