Detect Arista VeloCloud Orchestrator SQL Injection (CVE-2026-114625) in Elastic Security
Detects exploitation of CVE-2026-114625, a SQL injection vulnerability (CWE-89) in the Arista VeloCloud Orchestrator (VCO) web/API interface. This CISA KEV-listed flaw allows an attacker to inject arbitrary SQL through unsanitized parameters in VCO portal/API requests, enabling authentication bypass, extraction of orchestrator credentials and edge configuration, and potential full compromise of the SD-WAN control plane. Detection focuses on SQL injection signatures (UNION SELECT, boolean/time-based payloads, SQL metacharacters, error-based probes) in HTTP requests to VCO endpoints, anomalous database errors, and post-exploitation data access patterns.
MITRE ATT&CK
Elastic Detection Query
any where event.category == "web" and
(url.path like~ ("*/portal/*", "*/api/*", "*/login*", "*enterprise*", "*operator*")) and
(
stringContains(lower(url.query), "union select") or
stringContains(lower(url.query), "union all select") or
stringContains(lower(url.query), "' or '1'='1") or
stringContains(lower(url.query), "waitfor delay") or
stringContains(lower(url.query), "pg_sleep") or
stringContains(lower(url.query), "information_schema") or
stringContains(lower(url.query), "extractvalue(") or
stringContains(lower(url.query), "updatexml(") or
stringContains(lower(url.query), "@@version") or
stringContains(lower(url.query), "';--")
)EQL rule matching SQL injection payload substrings in web requests to VeloCloud Orchestrator endpoints.
Data Sources
Required Tables
False Positives & Tuning
- Authorized scanner and WAF validation traffic
- Benign requests whose query parameters contain SQL-like keywords
- Penetration testing activity
- Internal integration tooling with keyword-rich parameters
Other platforms for CVE-2026-114625
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 UNION-based SQLi probe against VCO login
Expected signal: Web/IIS log entry with 'UNION SELECT' in the query string to /portal/ path.
- Test 2 Time-based blind SQLi probe
Expected signal: Web log entry containing 'pg_sleep' with an elevated response latency (~5s).
- Test 3 Error-based SQLi via extractvalue
Expected signal: Web log with 'extractvalue' and '@@version' in the query; VCO DB error log entry.
References (4)
- https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-114625
Response Playbook
Triage
- Confirm the targeted host is an Arista VeloCloud Orchestrator and identify its version against Arista Security Advisory 0199 (CVE-2026-114625).
- Decode the full request (query string and body) and classify the SQLi technique: UNION-based, boolean/time-based blind, error-based, or stacked queries.
- Determine whether the HTTP responses indicate success — anomalous 200s with large/odd response sizes, database error strings, or time-delays consistent with injected sleep functions.
- Correlate the source IP against known scanner ranges, threat intel, and prior authentication activity to the VCO.
Containment
- Block the offending source IP(s) at the perimeter/WAF and restrict VCO portal/API access to trusted management networks only.
- If exploitation is confirmed, isolate the VCO management interface from the internet and apply the Arista-provided patch/mitigation from Advisory 0199 immediately.
- Rotate VCO operator, enterprise admin, and database credentials, plus any API tokens, as they may have been exfiltrated via the injection.
Evidence Collection
- Preserve web/IIS/WAF access logs, VCO application logs, and database query/error logs covering the full attack window.
- Capture the raw malicious requests and the corresponding response bodies and sizes for payload and data-exfiltration analysis.
- Export the VCO database audit/query logs to identify which tables and rows (users, edges, credentials) were accessed.
Escalation Criteria
- !Escalate to incident response if responses confirm successful data extraction (credentials, tokens, edge configuration) or authentication bypass.
- !Escalate to SD-WAN/network leadership if orchestrator compromise could propagate configuration changes to managed edge devices.
- !Escalate externally per CISA BOD 26-04 reporting obligations given the KEV status of this CVE.
Investigation Guide
Forensic Artifacts
- >
Web/IIS/WAF access logs showing SQLi payloads and anomalous response sizes - >
VCO database query and error logs - >
Application logs showing failed/odd authentication and API calls - >
Network capture of request/response pairs to the orchestrator
Tuning Guidance
Baseline legitimate VCO administrator source IPs and authorized scanner ranges, then exclude them. Tighten path matching to the actual VCO portal/API routes in your environment to reduce noise, and raise confidence when SQLi signatures co-occur with database error responses or anomalous response sizes. If request bodies are not logged, rely more heavily on query-string and response-anomaly signals.
Hunting Queries
Surfaces source IPs issuing high volumes of distinct queries or triggering many 5xx database errors against VCO endpoints — indicative of automated SQLi probing.
W3CIISLog | where csUriStem has_any ("/portal/","/api/","/operator") | summarize reqs=count(), distinctQueries=dcount(csUriQuery), errs=countif(scStatus startswith "5") by cIP, bin(TimeGenerated, 1h) | where distinctQueries > 50 or errs > 20index=web (uri_path="*/portal/*" OR uri_path="*/api/*") | stats count dc(uri_query) as uniqQ sum(eval(if(status>=500,1,0))) as errs by src_ip | where uniqQ>50 OR errs>20Atomic Red Team Tests
Sends a UNION SELECT injection payload to a lab VeloCloud Orchestrator login endpoint.
Command
curl -sk 'https://vco.lab.local/portal/rest/login/enterpriseLogin?username=admin%27%20UNION%20SELECT%20username%2Cpassword%20FROM%20users--%20&password=x'Cleanup
echo 'No cleanup required; stateless GET request.'Expected Telemetry
Web/IIS log entry with 'UNION SELECT' in the query string to /portal/ path.
Expected Detection
KQL/SPL rules fire on the union select signature against a VCO path.
Sends a time-based blind injection using a sleep function to a lab VCO API endpoint.
Command
curl -sk "https://vco.lab.local/portal/rest/enterprise/getEnterpriseUsers?enterpriseId=1%20AND%20(SELECT%201%20FROM%20pg_sleep(5))--"Cleanup
echo 'No cleanup required; stateless GET request.'Expected Telemetry
Web log entry containing 'pg_sleep' with an elevated response latency (~5s).
Expected Detection
Rules fire on the pg_sleep time-based injection signature.
Sends an error-based injection payload using extractvalue to a lab VCO endpoint to force a database error.
Command
powershell -Command "Invoke-WebRequest -SkipCertificateCheck -Uri 'https://vco.lab.local/portal/rest/enterprise/getConfig?id=1%27%20AND%20extractvalue(1,concat(0x7e,@@version))--'"Cleanup
Write-Output 'No cleanup required; stateless request.'Expected Telemetry
Web log with 'extractvalue' and '@@version' in the query; VCO DB error log entry.
Expected Detection
Rules fire on the extractvalue/@@version error-based signature and correlated 5xx response.