# CVE-2026-114625: VeloCloud Orchestrator (on-prem) SQL injection, detection pack

**Primary source:** Arista Security Advisory 0199 (22 Oct 2026, rev 1.0)
https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
CWE-89 · CVSS v3.1 9.9 (v4.0 9.4) · BUG2043622 · "detected by Arista and is known to be actively exploited".

## Facts (verified against Arista SA 0199 on 22 Oct 2026)
| Item | Value |
|---|---|
| Affected | VCO **On-Prem** 5.2.x < 5.2.3.18, 6.1.x < 6.1.3.10, 6.4.x < 6.4.2.12 |
| Fixed | 5.2.3.18+, 6.1.3.10+, 6.4.2.12+ (same train) |
| Not affected | VeloCloud Edge, VeloCloud Gateway; any release not listed (for example 7.0). End-of-support releases **not assessed**, so contact TAC |
| Hosted / Dedicated VCO | Were affected; Arista has already patched them |
| Preconditions | Network access to the VCO web UI and a valid session. Minimum role is Enterprise Read Only. Arista says no configuration prevents exposure |
| Impact | Any authenticated user can gain operator privileges / act as the local "superuser operator" and may affect the VCO host |
| Attacker IPs (Arista) | `74.82.197.86`, `38.54.50.151` |
| Log hints (Arista) | Unusual URL-like path components, encoded characters, references to local/internal services, high request rates |
| CISA KEV | **Not listed** (checked catalog version 2026.10.21, released 21 Oct 2026). Re-check later |
| NVD | No record yet (API returned 0 results on 22 Oct 2026) |

Related but separate: SA 0183 (`24765-security-advisory-0183`) covers **CVE-2026-93952** (Sept 2026), not this CVE. Releases that fixed that flaw (5.2.3.16, 6.4.2.8) are still vulnerable to CVE-2026-114625. SA 0183's own IOCs are **not** in this pack.

## Proactive
1. Upgrade on-prem VCO to the fixed release for your train. If your train is unsupported, contact Arista TAC.
2. Until you have upgraded, allow access to the VCO web UI only from trusted admin networks (FW/ACL). Hosted customers have no patching to do.
3. Audit customer, partner and operator accounts. Remove unused ones, especially low-privilege tenant users, since any login is enough.
4. Block the two IPs both ways. Restrict VCO egress to the ports and destinations it needs.
5. Deploy the KQL/Sigma hunts below and alert on any IOC hit.

## Reactive (if exposed or suspected)
1. **Preserve evidence before patching:** VCO web access logs (nginx), backend application logs, system logs, database logs, and file-system timestamps. If possible, snapshot the VM.
2. Look for webshells, unexpected daemons/services, new files in web or system paths, and unexpected outbound connections.
3. Review administrator activity: new or elevated operator/superuser users, role changes, API tokens, and configuration pushes.
4. If you confirm a compromise, treat the managed Edges and all tenants/customers as exposed. Rotate credentials and secrets and validate device configuration. SA 0199 does not say whether the Edge risk applies. Arista stated it for the earlier flaws (SA 0183), so assume it does. Engage Arista TAC.

## Usage
```bash
./check_vco.sh --version 6.4.2.10
./check_vco.sh --version-file exported_version.txt --log /var/log/nginx/access.log --log access.log.1.gz [--spike-threshold 300] [--strict-logs]
```
```powershell
pwsh ./Check-VCO.ps1 -Version 6.4.2.10 -LogPath .\access.log -StrictLogs
```
Exit codes: `0` PATCHED (or not affected), `1` LIKELY VULNERABLE (or log indicators found with `--strict-logs`), `2` UNKNOWN, `3` error.
Both scripts are read-only. They make no network calls and do no probing.

* `kql/vco_cve_2026_114625_hunts.kql`: IOC IPs in both directions (CommonSecurityLog, DeviceNetworkEvents, Syslog), web anomalies, request spikes, new outbound connections from the VCO host, and an admin-change starting point. Set `VcoHosts`/`VcoNames`.
* `sigma/`: webserver rule (IOC IPs plus generic URL-like/encoded-slash path segments) and a firewall rule (IOC IPs as src or dst).
* `tests/run_tests.sh`: shellcheck, fixtures for every verdict and exit code, log-scan fixtures, pwsh parse, Pester, `sigma check`.

## Limits / unverified
* **Automatic version detection is not implemented.** Arista does not document a local version file or package path that I could confirm, so you must supply the version (from the VCO UI or a support bundle).
* The log heuristics are generic and come from Arista's wording. Percent-encoding is common in normal traffic. No exploit payload signatures are included, and none have been published.
* The spike heuristic assumes nginx combined/common log format.
* The KQL is **untested against a live tenant**. Field names in VCO audit events are not confirmed.
* The IPs are point-in-time and may be reassigned. Absence of hits does not prove there was no compromise.