Hunting VeloCloud Orchestrator exploitation: what CVE-2026-114625 leaves in the logs

When Arista disclosed CVE-2026-114625 as exploitable, it provided guidance for defenders to identify the attack in their logs. Two source addresses were identified and the logs were highlighted to detect the SQL injection. This is significant because the vulnerability is behind a login; a legitimate session would still bypass the injection.

The root cause of CVE-2026-114625 is a SQL injection in VeloCloud Orchestrator, the management system for VeloCloud SD-WAN. An attacker with a valid login (Enterprise Read Only or above) can exploit the vulnerability. Arista describes the impact as operating with superuser privileges, allowing complete access. The affected interface is intentionally reachable, as per Arista.

The vendor provided two IP addresses that were observed carrying out the attacks: 74.82.197[.]86 and 38.54.50[.]151. Blocking these addresses is a starting point, but searching historical logs for any signs of these addresses is more informative. Red flags in VCO web access logs include unusual URL-like path components, encoded characters, references to internal services, and high request rates.

It's important to note that requests may carry valid session cookies, so filtering on failed authentication misses these. Accounts with read-only permissions are the minimum level for exploitation, so auditor accounts making write-shaped requests should be investigated. Exploitation widens with partner accounts managing multiple customers.

Arista suggests monitoring the VCO host for unexpected outbound network activity, blocking unnecessary outbound ports, and looking for backdoor daemons and webshells. These steps assume an attacker already has operator rights and may want persistence. Before remediating, Arista recommends saving various logs and file-system timestamps as evidence.

The 7.0 train is not vulnerable, and builds that fixed previous VCO flaws are still at risk. Arista does not clarify if upgrading removes existing access or if a compromised orchestrator can still reach VeloCloud Edge devices. Further investigation into operator tier verification and recent administrator activity is advised to detect any actions left behind by the intrusion.