Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Arista patches exploited VeloCloud Orchestrator flaw CVE-2026-114625

8 sources · 8 articlesFirst reported Updated ()2 · 1 read
What's new

October 24: Security Affairs says CISA listed attack IPs 74.82.197.86 and 38.54.50.151; other outlets attribute those addresses to Arista.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Arista patched actively exploited on-premises VeloCloud flaw CVE-2026-114625; U.S. agencies must fix it by October 26.

On October 22, 2026, Arista said attackers were exploiting CVE-2026-114625, an authenticated SQL injection in on-premises VeloCloud Orchestrator. A logged-in user, including Enterprise Read Only, can gain operator privileges and reach local superuser functions. Fixes are 5.2.3.18, 6.1.3.10, and 6.4.2.12; hosted and Dedicated orchestrators were already patched. Gateway, Edge, and unlisted releases including 7.0 are unaffected. SecurityWeek and The Hacker News report CVSS 9.9; Security Affairs reports 9.4, and Cyber Security News cites 9.9 (v3.1) and 9.4 (v4.0). CISA added it to KEV with an October 26 federal deadline and lists ransomware use as unknown.

Key facts
  • On-prem fixes are 5.2.3.18, 6.1.3.10, and 6.4.2.12 or later.
  • Enterprise Read Only can reach superuser operator functions.
  • Arista named sources 74.82.197.86 and 38.54.50.151.
  • CISA KEV deadline is October 26, 2026; ransomware use unknown.
  • Arista advisory 0199 tracks BUG2043622; weakness is CWE-89.
  • The web interface is exposed by default; no setting removes that.
Analyze CVE-2026-114625 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 22, 2026Arista says CVE-2026-114625 is exploited in the wild · The Hacker News
  2. Oct 23, 2026CISA adds CVE-2026-114625 to the KEV catalog · CISA Known Exploited Vulnerabilities
  3. Oct 23, 2026Canada issues alert AV26-1080 on the flaw · Canadian Centre for Cyber Security
  4. Oct 26, 2026Federal agencies’ KEV remediation deadline · CISA Known Exploited Vulnerabilities

What each outlet adds

beyond the shared facts
  • The Hacker NewsThree fixed trains; Gateway, Edge, and 7.0 unaffected
  • CISA Known Exploited VulnerabilitiesKEV deadline October 26; ransomware use unknown
  • SecurityWeekCalls it the third exploited VCO zero-day in four months
  • Cyber Security NewsAdvisory 0199, BUG2043622, CWE-89, and both CVSS scores
  • Security AffairsAttributes the two attack IP addresses to CISA
CVEs
CVE-2026-114625
Vendors
Arista NetworksAristaVeloCloud
Products
VeloCloud OrchestratorVeloCloud SD-WAN
Organizations
CISACanadian Centre for Cyber Security
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 3d ago BleepingComputerFirst report

    Arista patches VeloCloud zero-day exploited in attacks

    CVE-2026-114625 SQL injection flaw in VeloCloud Orchestrator allows authenticated privilege escalation.

  2. · 3d ago The Hacker News

    Arista says VeloCloud SQL injection zero-day is exploited

    A read-only login can become a local superuser; on-prem fixes are 5.2.3.18, 6.1.3.10 and 6.4.2.12.

  3. · 3d ago CISA Known Exploited Vulnerabilities

    CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV

    Authenticated users can become a superuser operator on on-prem VCO; federal due date is October 26, 2026.

  4. · 2d ago SOCRadar

    Actively exploited VeloCloud Orchestrator flaw grants superuser access

    The headline names CVE-2026-114625 as exploited; the supplied page text does not state versions or a fix.

  5. · 2d ago SecurityWeek

    Attackers exploit VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625

    Any authenticated user on unpatched on-prem VCO can become a superuser operator; Arista says hosted systems are already patched.

  6. · 2d ago Canadian Centre for Cyber Security

    Arista says VeloCloud Orchestrator flaw CVE-2026-114625 is exploited

    Builds before 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected; Canada's Cyber Centre urges available updates.

  7. · 2d ago Cyber Security News

    Attackers exploit VeloCloud Orchestrator flaw for superuser access

    CVE-2026-114625 is an authenticated SQL injection; Enterprise Read Only is enough, and Arista named two attacking IPs.

  8. · 1d ago Security Affairs

    CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV

    Authenticated SQL injection CVE-2026-114625 can grant operator privileges; federal agencies must fix it by October 26, 2026.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-114625
SQL injection in Arista VeloCloud Orchestrator grants superuser
9.41%KEV
KEV