# Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks · pwn.watch

> Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.

Page: https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625 · generated 2026-10-23T00:16:28.879Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Arista VeloCloud Orchestrator (VCO) On-Prem
- Started: 2026-10-22
- CVEs: CVE-2026-114625
- Affected: VCO 5.2.x before 5.2.3.18; VCO 6.1.x before 6.1.3.10; VCO 6.4.x before 6.4.2.12
- Fixed in: 5.2.3.18; 6.1.3.10; 6.4.2.12

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625/feed.xml
- JSON Feed: https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625.json
- This file: https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625/llms.txt

## Updates (newest first)
- 2026-10-22: Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected. (https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/)

## Fix brief
# Security brief: Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks

Source: https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625 · status: live · severity: critical · updated Oct 23, 2026, 02:15 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.

Severity detail: CVSS 9.9, exploited in the wild as a zero-day

- Product: Arista VeloCloud Orchestrator (VCO) On-Prem
- CVE / advisory ids: CVE-2026-114625

## Affected versions
- VCO 5.2.x before 5.2.3.18
- VCO 6.1.x before 6.1.3.10
- VCO 6.4.x before 6.4.2.12

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 5.2.3.18
- 6.1.3.10
- 6.4.2.12

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Oct 22, 2026: Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected.

## Advisories
- [NVD: CVE-2026-114625](https://nvd.nist.gov/vuln/detail/CVE-2026-114625) (NVD)
- [NCSC-2026-0385](https://advisories.ncsc.nl/2026/ncsc-2026-0385.html) (NCSC NL)

## Write-ups & news
- [Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks](https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html)
- [Arista patches new VeloCloud Orchestrator zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/)
- [VeloCloud Orchestrator Vulnerability Exploited in the Wild](https://securityonline.info/velocloud-orchestrator-cve-2026-114625-exploited/)

## Caveats
Fourth exploited Arista zero-day of 2026 (after CVE-2026-7473, CVE-2026-16812 and CVE-2026-93952). VeloCloud Gateway, Edge and EOS are reported as not affected. NVD record not yet published at time of adding.

---
Machine-readable: https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.