Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625) lets any logged-in user act as superuser operator, exploited
Any authenticated user of on-prem VeloCloud Orchestrator can become superuser operator; Arista says it is exploited. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12.
- Published
- Updated
- Ecosystem
- Network edgeEnterprise software
- Fixed in
- VCO 5.2.3.18, 6.1.3.10, 6.4.2.12 and later; hosted and Dedicated VCO already patched
- Exploitation
- Yes. Arista says it “is known to be actively exploited” (22 October 2026); in CISA KEV since 23 October
Live scores
CVE-2026-114625- EPSS
- 0.010
some chance of attack soon - VEDAS
- 0.515
some exploit evidence - On CISA KEV
- Yes, since 2026-10-23
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
What happened
On 22 October 2026, Arista published Security Advisory 0199 for CVE-2026-114625, a SQL injection in on-premises VeloCloud Orchestrator (VCO), the management plane for VeloCloud SD-WAN (formerly VeloCloud Orchestrator by Broadcom). It is rated CVSS 3.1 9.9 and CVSS 4.0 9.4 (Arista).
On an affected system, “any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user.” That includes functions meant for internal use only and not meant to be reachable remotely. Arista says this can compromise the orchestrator, the VCO host and the data the orchestrator manages (Arista).
The attacker needs a valid session with any role from Enterprise Read Only up, and network access to the VCO web interface. Arista says “VCO is exposed by default” and no configuration prevents the exposure. The issue “was detected by Arista and is known to be actively exploited” (Arista). CISA added it to the KEV catalog on 23 October 2026, with a federal due date of 26 October, and requires forensic triage (CISA KEV).
Why this matters
The lowest built-in tenant role is the whole barrier. Every account on the orchestrator, not just the admins, is a way in, so one phished or reused read-only password is enough. And the orchestrator is where the SD-WAN is managed: Arista warns that the data it manages is at risk too.
Am I affected?
On-premises VCO in these trains is affected (Arista):
- 5.2.x before 5.2.3.18
- 6.1.x before 6.1.3.10
- 6.4.x before 6.4.2.12
End-of-support trains were not assessed; Arista asks those customers to contact TAC. VeloCloud Edge and VeloCloud Gateway are not affected. Hosted VCO, including Dedicated, was affected and Arista has already patched it.
Hunt for exploitation. Arista gives these indicators:
- Source IPs
74.82.197.86and38.54.50.151in VCO web access logs. - Web requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates. Pay most attention to such requests from low-privilege tenant accounts.
- Unexpected outbound connections from the VCO host.
- Backdoor daemons or web shells on the VCO host.
- Administrator changes nobody made.
What to do now
- Upgrade to VCO 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later in your train.
- Before patching, if compromise is possible, preserve evidence: VCO web access logs, backend application logs, system logs, database logs and file-system timestamps (Arista). Upgrading can overwrite what you need.
- Restrict the web interface to trusted administrative networks until you are patched.
- Block
74.82.197.86and38.54.50.151, and block outbound ports the VCO host does not need. - Review accounts. List every tenant user, including Enterprise Read Only accounts, and remove ones that are not needed. Check recent operator and administrator activity for changes you did not make.
- If you find signs of compromise, treat the VCO host as compromised: look for web shells and unknown daemons, and review configuration pushed to edges since the earliest suspicious request.