Arista says VeloCloud Orchestrator flaw CVE-2026-114625 is exploited
Original title: Arista Networks security advisory (AV26-1080)
Builds before 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected; Canada's Cyber Centre urges available updates.
The Canadian Centre for Cyber Security alert AV26-1080, dated October 23, 2026, says Arista Networks' VeloCloud Orchestrator is vulnerable in releases before 5.2.3.18, 6.1.3.10, and 6.4.2.12. As of October 22, Arista indicates CVE-2026-114625 is exploited in the wild. The alert points administrators to Arista Security Advisory 0199 and says to apply updates as they become available. It does not describe the flaw's impact.
Unconfirmed: The alert relays Arista's claim of exploitation and does not describe what the flaw allows.
- The Cyber Centre serial is AV26-1080, dated October 23, 2026.
- Arista's exploitation statement is dated as of October 22, 2026.
- Affected lines are before 5.2.3.18, 6.1.3.10, and 6.4.2.12.
- Users are directed to Arista Security Advisory 0199.
| Product | Affected | Fixed in |
|---|---|---|
| Arista Networks VeloCloud Orchestrator (VCO) | prior to 5.2.3.18; prior to 6.1.3.10; prior to 6.4.2.12 | 5.2.3.18, 6.1.3.10, 6.4.2.12 |
- 1.Review Arista Security Advisory 0199 and apply available VeloCloud Orchestrator updates.
- CVEs
- CVE-2026-114625
- Vendors
- Arista Networks
- Products
- VeloCloud Orchestrator
- Organizations
- Canadian Centre for Cyber Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114625 | SQL injection in Arista VeloCloud Orchestrator grants superuser | 9.4 | 1% | KEV | KEV |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1080 Date: October 23, 2026 As of October 22, 2026, Arista Networks is affected by a vulnerability in the following product: VeloCloud Orchestrator (VCO) Prior to 5. 2. 3.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.