Actively exploited VeloCloud Orchestrator flaw grants superuser access
Original title: CVE-2026-114625: Actively Exploited VeloCloud Orchestrator Flaw Grants Superuser Access
The headline names CVE-2026-114625 as exploited; the supplied page text does not state versions or a fix.
A SOCRadar post headline says CVE-2026-114625 in VeloCloud Orchestrator is actively exploited and grants superuser access. The captured page is site navigation and does not describe affected builds, a patch, or how the flaw is reached. Defenders should treat exploitation as claimed by that headline until the article body is available.
Unconfirmed: Only the headline is present, so versions, patch status and attack method are not confirmed in the text.
- The headline identifies the product as VeloCloud Orchestrator.
- It says the flaw grants superuser access.
- No affected or fixed version appears in the supplied text.
Impact: superuser access on VeloCloud Orchestrator
| Product | Affected |
|---|---|
| VeloCloud Orchestrator | — |
- CVEs
- CVE-2026-114625
- Vendors
- VeloCloud
- Products
- VeloCloud Orchestrator
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114625 | SQL injection in Arista VeloCloud Orchestrator grants superuser | 9.4 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 38.54.50.151 | escalation. Arista observed attacks from 74.82.197.86 and 38.54.50.151. These addresses are useful hunt leads, but their absence d |
| ipv4 | 5.2.3.18 | e train Affected releases Fixed release 5.2 Earlier than 5.2.3.18 5.2.3.18 or later 6.1 Earlier than 6.1.3.10 6.1.3.10 or l |
| ipv4 | 6.1.3.10 | Earlier than 5.2.3.18 5.2.3.18 or later 6.1 Earlier than 6.1.3.10 6.1.3.10 or later 6.4 Earlier than 6.4.2.12 6.4.2.12 or l |
| ipv4 | 6.4.2.12 | Earlier than 6.1.3.10 6.1.3.10 or later 6.4 Earlier than 6.4.2.12 6.4.2.12 or later VeloCloud Gateway and VeloCloud Edge ar |
| ipv4 | 74.82.197.86 | n after privilege escalation. Arista observed attacks from 74.82.197.86 and 38.54.50.151. These addresses are useful hunt leads, bu |
From the original article
11 min read at socradar.io
CVE-2026-114625 is an actively exploited SQL injection flaw in VeloCloud Orchestrator that lets authenticated users gain superuser operator privileges...
By Ameer Owda · socradar.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.