Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks
Arista VeloCloud Orchestrator (VCO) On-Prem
Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.
Why this severity: CVSS 9.9, exploited in the wild as a zero-day
- Started
- Oct 22, 2026
Affected
- VCO 5.2.x before 5.2.3.18
- VCO 6.1.x before 6.1.3.10
- VCO 6.4.x before 6.4.2.12
Fixed in
- 5.2.3.18
- 6.1.3.10
- 6.4.2.12
Timeline1
Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected.
Source
Advisories2
News & write-ups3
Posts2
‼️ Critical VeloCloud SQL injection flaw exploited in the wild. Tracked as CVE-2026-114625 (CVSS 9.9), the flaw lets even read-only users escalate to full operator privileges. Arista confirms active attacks. What admins need to know ↓ t.co/NHJ4SMAP84
🚨 Critical Arista VeloCloud Orchestrator SQL injection flaw actively exploited Arista has disclosed CVE-2026-114625, a critical vulnerability affecting on-premises VeloCloud Orchestrator deployments. ⠀ The SQL injection flaw allows any authenticated user, including someone t.co/YmvPfvAwhb
Notes & caveats
Fourth exploited Arista zero-day of 2026 (after CVE-2026-7473, CVE-2026-16812 and CVE-2026-93952). VeloCloud Gateway, Edge and EOS are reported as not affected. NVD record not yet published at time of adding.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
