Threat Overview
Arista disclosed an actively exploited SQL injection in VeloCloud Orchestrator (VCO) on-premises deployments. An attacker with a valid VCO portal session—even an Enterprise Read Only tenant account—can impersonate a local superuser operator and reach privileged internal functions. The potential blast radius includes centralized SD-WAN administration and data managed by the orchestrator. Arista did not publish a request payload, exploited URL path, or confirmed post-exploitation commands; none are inferred here. This is distinct from earlier VCO flaws disclosed in July and September 2026.
References
Arista Security Advisory 0199 — October 22, 2026
The Hacker News — October 22, 2026
Impacted Systems
Vendor/product: Arista VeloCloud Orchestrator (formerly Broadcom/VMware VCO), on-prem/self-managed web management and SD-WAN orchestration role. Affected: 5.2.x <5.2.3.18; 6.1.x <6.1.3.10; 6.4.x <6.4.2.12. Fixed: 5.2.3.18, 6.1.3.10, 6.4.2.12 or later in the corresponding trains. Prerequisites: network access to the VCO web portal and a valid session with at least Enterprise Read Only role. Exposure: VCO web interface is exposed by default; specific port not stipulated in advisory. Hosted/Dedicated: affected but vendor says already patched. Explicitly unaffected: VeloCloud Gateway and Edge. Unsupported release trains were not assessed.
Why this matters
An authenticated low-privilege foothold can become operator-level control of an SD-WAN management plane, enabling changes to many managed environments. Existing patches for prior VCO issues do not necessarily remediate this flaw.
Exploitation Status
Arista's October 22 advisory explicitly confirms active exploitation and identifies source IPs 74.82.197.86 and 38.54.50.151. It advises examining anomalous URL-like path components, encoding, local/internal references, and high request rates. No public evidence in the reviewed primary advisory identifies specific SQL payload strings or a post-exploitation malware family.
What this hunt looks for
Layered Sentinel hunts cover confirmed indicators, product-scoped activity, and post-compromise behavior. Queries are not customer findings; detection confidence and missing telemetry are described below.
Required logs
CommonSecurityLog; DeviceFileEvents; DeviceNetworkEvents; DeviceProcessEvents; Syslog
Hunt 1: Known exploitation-source IPs against network infrastructure
Required tables: CommonSecurityLog | Signal: High. Arista confirmed these IPs in exploitation activity. Validate that DestinationIP belongs to VCO before interpreting a match; source-IP reuse and scanning are possible.
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| where SourceIP in ("74.82.197.86", "38.54.50.151")
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, DestinationPort, DeviceVendor, DeviceProduct, DeviceAction, DeviceEventClassID, RequestURL, Message
| order by TimeGenerated descHunt 2: Vendor-specific VCO SQL-injection IPS/WAF alert
Required tables: CommonSecurityLog | Signal: High. Only works when an actual vendor detection name or CVE is forwarded. No such signature is asserted to exist in a given firewall.
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Evidence=strcat(tostring(DeviceEventClassID)," ",tostring(Activity)," ",tostring(Message)," ",tostring(AdditionalExtensions))
| where Evidence contains "CVE-2026-114625" or (Evidence contains "VeloCloud" and Evidence has_any ("SQL injection", "SQLi", "privilege escalation"))
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, DeviceVendor, DeviceProduct, DeviceAction, DeviceEventClassID, Activity, Message
| order by TimeGenerated descHunt 3: VCO-targeted abnormal encoded web requests
Required tables: CommonSecurityLog | Signal: Medium. Conditional VCO identification: populate VcoIPs for hosts without recognizable DNS names. These are vendor-advised anomaly classes, not a confirmed exploit payload; manual validation required.
let VcoIPs=dynamic([]);
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Uri=tostring(RequestURL), Host=tostring(DestinationHostName)
| where (array_length(VcoIPs)>0 and set_has_element(VcoIPs,DestinationIP)) or Host contains "velocloud" or Host contains "vco"
| where Uri contains "%25" or Uri contains "%2e" or Uri contains "%2f" or Uri contains "../" or Uri contains "127.0.0.1" or Uri contains "localhost"
| summarize Requests=count(), Paths=make_set(Uri,12), Actions=make_set(DeviceAction,8), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, Host
| order by Requests descHunt 4: VCO application log privileged-user masquerade
Required tables: Syslog | Signal: Medium. Requires VCO application/audit events forwarded into Syslog. String patterns are contextual and not guaranteed VCO log formats.
Syslog
| where TimeGenerated >= ago(14d)
| where ProcessName contains "vco" or ProcessName contains "velocloud" or SyslogMessage contains "VeloCloud" or SyslogMessage contains "superuser operator"
| where SyslogMessage has_any ("superuser", "operator", "privilege", "impersonat", "masquerad")
| project TimeGenerated, Computer, ProcessName, SeverityLevel, SyslogMessage
| order by TimeGenerated descHunt 5: VCO-named host web-service parent launching shell
Required tables: DeviceProcessEvents | Signal: High. Requires endpoint coverage of VCO and recognizable host naming. Process ancestry is a post-compromise pivot, not proof of this SQLi.
DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where DeviceName contains "vco" or DeviceName contains "velocloud"
| where InitiatingProcessFileName in~ ("java", "nginx", "apache2", "httpd", "sh", "bash")
| where FileName in~ ("sh", "bash", "dash", "python", "python3", "curl", "wget", "nc", "ncat", "socat")
| where ProcessCommandLine has_any ("/dev/tcp/", "curl", "wget", "base64", "chmod", "nohup", "nc -", "socat")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated descHunt 6: New public egress from VCO-named hosts
Required tables: DeviceNetworkEvents | Signal: Medium. Contextual anomaly only. Host naming, egress baselines, and the VCO device role must be confirmed.
let Baseline=DeviceNetworkEvents
| where TimeGenerated between (ago(30d)..ago(7d))
| where DeviceName contains "vco" or DeviceName contains "velocloud"
| where RemoteIPType =~ "Public"
| summarize by DeviceId, RemoteIP, RemotePort;
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where DeviceName contains "vco" or DeviceName contains "velocloud"
| where RemoteIPType =~ "Public" and RemotePort !in (53,80,123,443)
| join kind=leftanti Baseline on DeviceId, RemoteIP, RemotePort
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated descHunt 7: VCO-named host persistence-path file writes
Required tables: DeviceFileEvents | Signal: Medium. Requires EDR on the Linux orchestrator. Maintenance may change these paths; this is a follow-up pivot, not an exploit signature.
DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where DeviceName contains "vco" or DeviceName contains "velocloud"
| where ActionType in~ ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath startswith "/etc/cron" or FolderPath startswith "/etc/systemd/system/" or FolderPath contains "/.ssh/authorized_keys"
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated descDetection Notes
Highest-signal: vendor-confirmed attacker IPs hitting a validated VCO destination and any explicit CVE signature; EDR web-worker shell execution is strong post-compromise evidence if VCO is onboarded. The URI anomaly and egress/persistence hunts are contextual and must be host-scoped; no VCO asset list or host-naming convention is assumed. Ordinary firewall flows cannot prove SQL injection, role escalation, or superuser impersonation. Hostname-scoped hunts may miss VCO servers named differently. Missing VCO application/audit logs, HTTP URI detail, and Linux EDR sharply limit coverage.
Visibility is limited to telemetry actually ingested into Microsoft Sentinel; no customer workspace was queried for this publication.
