Attackers exploit VeloCloud Orchestrator flaw for superuser access
CVE-2026-114625 is an authenticated SQL injection; Enterprise Read Only is enough, and Arista named two attacking IPs.
84
Vendor
Arista Networks
- Mentions · 7d0
- Mentions · 30d3
- All mentions6
- First seenSep 18, 2026
- Last mentioned19d ago
Timeline
6 articles · newest firstArista says VeloCloud Orchestrator flaw CVE-2026-114625 is exploited
Builds before 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected; Canada's Cyber Centre urges available updates.
74
Attackers exploit VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625
Any authenticated user on unpatched on-prem VCO can become a superuser operator; Arista says hosted systems are already patched.
82
Arista Networks security advisory (AV26-1015)
Canada’s Cyber Centre warns Arista CloudVision CUE versions through 2026.2.0 are affected by unspecified vulnerabilities.
24
Arista Networks security advisory (AV26-947)
Canada's Cyber Centre warns CVE-2026-93952 in Arista VeloCloud Orchestrator is being exploited in the wild.
76
Arista Networks security advisory (AV26-940)
Canadian Cyber Centre relays Arista Networks Security Advisory 0174 covering multiple vulnerabilities in EOS across several versions and platforms.
25
Related CVEs
by mentions- CVE-2026-1146251%9.4SQL injection in Arista VeloCloud Orchestrator grants superuser
- CVE-2026-939521%9.5Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem)
Appears with
- VeloCloud Orchestratorproduct · 4
- Canadian Centre for Cyber Securityorganization · 4
- Arista Networksorganization · 1
- CloudVision CUEproduct · 1
- EOSproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.