Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV

Original title: CISA KEV: Arista VeloCloud Orchestrator SQL Injection Vulnerability — Arista VeloCloud Orchestrator (CVE-2026-114625)

CISA Known Exploited Vulnerabilities ()1 min read
Read at cisa.gov
Part of a story covered by 8 sourcesArista patches exploited VeloCloud Orchestrator flaw CVE-2026-114625Merged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Authenticated users can become a superuser operator on on-prem VCO; federal due date is October 26, 2026.

CISA added CVE-2026-114625, affecting Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities catalog. On affected on-prem systems, any authenticated user can gain operator privileges and reach internal functionality intended only for a local superuser operator. Hosted and Dedicated VCO deployments were affected and have already been patched. Ransomware use is listed as unknown, and the required action deadline is October 26, 2026.

Unconfirmed: The catalog lists known ransomware campaign use as unknown.

Key facts
  • The catalog entry is CVE-2026-114625.
  • Successful use can affect orchestrator confidentiality, integrity, and availability.
  • Hosted, including Dedicated, VCO versions have already been patched.
  • Known ransomware campaign use is listed as unknown.
  • BOD 26-04 compliance is due October 26, 2026.
Security assessment · AI, from the articleExploited in the wild

Impact: Authenticated users gain operator privileges on the orchestrator

ProductAffectedFixed in
Arista VeloCloud Orchestratoron-prem affected; hosted and Dedicated versions impactedhosted and Dedicated versions already patched
What to do
  1. 1.Apply mitigations per vendor instructions and CISA BOD 26-04.
  2. 2.Meet the October 26, 2026 action due date.
  3. 3.Discontinue use if mitigations are unavailable.
Analyze CVE-2026-114625 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-114625
ATT&CK
T1190 Exploit Public-Facing Application
Tags
cisa-kevvelocloudaristaprivilege-escalationsql-injection
Vendors
Arista
Products
VeloCloud Orchestrator
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-114625
SQL injection in Arista VeloCloud Orchestrator grants superuser
9.41%KEV
KEV

From the original article

1 min read at cisa.gov

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.