CVE-2026-114625 Exploited in the wild
Arista VeloCloud Orchestrator SQL Injection Vulnerability
- Risk score
- 100/100
- CVSS
- 9.9 v3.1
- Exploit chance (30 days)
- 0.8%
- Published
- 22 Oct 2026
- Added to CISA's exploited list
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Arista VeloCloud Orchestrator has a SQL injection vulnerability that allows a remote attacker to access privileged functionality and potentially compromise the orchestrator and data. An authenticated user can gain operator privileges and access internal functionality.
- Affected
- {'products': ['VeloCloud Orchestrator'], 'packages': [], 'versions': ['on-prem']}
- Fix
- Apply mitigations in accordance with vendor instructions, or discontinue use of the product if mitigations are unavailable
- Exploitation
- Exploited in the wild
In the news
TL;DR
Arista VeloCloud Orchestrator has a critical SQL injection vulnerability (CVE-2026-114625) that allows attackers to access privileged functionality and impact the VCO host, with exploitation confirmed in the wild.
- Arista has patched hosted VCO deployments, but urges users to update on-premises installations as soon as possible.
- VCO deployments are exposed by default, and attackers need access to the VCO web interface and a valid authenticated session.
- The vulnerability affects all VCO releases before versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.
- Arista has already patched hosted VCO deployments, but users are responsible for updating on-premises installations.
AI summary of 2 articles.
Why it is Red
- CVSS 9.9 critical
- Exploited in the wild (CISA KEV)
- Named in a government or vendor bulletin
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Government and vendor bulletins
References
Original description
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Last activity 23 Oct 2026. Patch Forecast updates every hour.