Arista patches VeloCloud zero-day exploited in attacks
CVE-2026-114625 SQL injection flaw in VeloCloud Orchestrator allows authenticated privilege escalation.
85
CVE-2026-114625
SQL injection in Arista VeloCloud Orchestrator grants superuser
CISA: Arista VeloCloud Orchestrator SQL Injection Vulnerability
- CVSS 4.0
- 9.4 critical
- EPSS
- 1%p63
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
A SQL injection flaw in Arista VeloCloud Orchestrator lets any authenticated user reach privileged internal functions that are not meant to be remotely accessible, then act as a local superuser operator. A remote attacker with a valid account can compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages. Both on-premises and hosted (including Dedicated) deployments are affected; hosted instances have already been patched.
What to do: Apply Arista’s mitigations for CVE-2026-114625; hosted and Dedicated VCO are already patched. If mitigations are unavailable, discontinue use, per CISA’s BOD 26-04 guidance.
| Product | Affected |
|---|---|
| Arista VeloCloud Orchestrator | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
KEVCISA Known Exploited Vulnerability
- Affected
- Arista VeloCloud Orchestrator
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- arista
- Products
- velocloud orchestrator
- Weakness
- CWE-89
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
10 storiesCISA adds exploited Collabora Online and VeloCloud flaws to KEV
FCEB agencies must patch command injection in Collabora CODE Server and SQL injection in on-prem VeloCloud Orchestrator by October 26.
84
Attackers exploit VeloCloud Orchestrator flaw for superuser access
CVE-2026-114625 is an authenticated SQL injection; Enterprise Read Only is enough, and Arista named two attacking IPs.
84
Arista says VeloCloud SQL injection zero-day is exploited
A read-only login can become a local superuser; on-prem fixes are 5.2.3.18, 6.1.3.10 and 6.4.2.12.
84
Attackers exploit VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625
Any authenticated user on unpatched on-prem VCO can become a superuser operator; Arista says hosted systems are already patched.
82
CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV
Authenticated SQL injection CVE-2026-114625 can grant operator privileges; federal agencies must fix it by October 26, 2026.
78
Actively exploited VeloCloud Orchestrator flaw grants superuser access
The headline names CVE-2026-114625 as exploited; the supplied page text does not state versions or a fix.
76
Arista says VeloCloud Orchestrator flaw CVE-2026-114625 is exploited
Builds before 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected; Canada's Cyber Centre urges available updates.
74
CISA adds exploited Arista VeloCloud Orchestrator SQL injection to KEV
CVE-2026-114625 is listed on evidence of active exploitation; FCEB agencies must prioritize remediation under BOD 26-04.
74
CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV
Authenticated users can become a superuser operator on on-prem VCO; federal due date is October 26, 2026.
74