CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV
Original title: U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog
Authenticated SQL injection CVE-2026-114625 can grant operator privileges; federal agencies must fix it by October 26, 2026.
CISA added critical Arista VeloCloud Orchestrator flaw CVE-2026-114625, CVSS 9.4, to the Known Exploited Vulnerabilities catalog. On-premises VCO is vulnerable by default: any authenticated user, including Enterprise Read Only, can gain operator privileges and impersonate a local superuser operator. Hosted VCO versions, including Dedicated, were already patched. Federal agencies must remediate by October 26, 2026.
Unconfirmed: The article does not name affected on-premises version ranges or a specific fixed build.
- The flaw is SQL injection in the on-premises orchestrator web interface.
- No configuration change prevents exposure once a valid account can reach the interface.
- CISA lists attack-linked addresses 74.82.197.86 and 38.54.50.151.
- Administrators should review web logs for unusual or encoded requests.
Impact: Authenticated user gains operator privileges and can impersonate superuser
| Product | Affected |
|---|---|
| Arista VeloCloud Orchestrator | on-premises VCO, vulnerable by default |
- 1.Block 74.82.197.86 and 38.54.50.151 and review web logs for unusual requests.
- 2.Federal agencies must remediate CVE-2026-114625 by October 26, 2026.
- 3.If an attack is suspected, preserve web, application, system, and database logs first.
- CVEs
- CVE-2026-114625
- Vendors
- Arista
- Products
- VeloCloud Orchestrator
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114625 | SQL injection in Arista VeloCloud Orchestrator grants superuser | 9.4 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 38.54.50.151 | so block these IP addresses linked to attacks: 74.82.197.86 38.54.50.151 If an attack is suspected, administrators should save web, |
| ipv4 | 74.82.197.86 | hey should also block these IP addresses linked to attacks: 74.82.197.86 38.54.50.151 If an attack is suspected, administrators shou |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.