CVE-2026-114625 is a SQL injection vulnerability in the on-premises Arista VeloCloud Orchestrator that lets any authenticated user execute crafted database operations to gain operator-level privileges and masquerade as a local superuser operator, reaching internal-only functionality; Arista confirms active exploitation and CISA added it to KEV the day after publication.
Vulnerability summary
CVSS base score
9.9
Critical severity
EPSS score (FIRST)
0.6%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2026-114625 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Arista VeloCloud Orchestrator (VCO), on-premises deployments | cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* | 5.2.0 through 5.2.3.17 (fixed in 5.2.3.18); 6.1.0 through 6.1.3.9 (fixed in 6.1.3.10); 6.4.0 through 6.4.2.11 (fixed in 6.4.2.12). Hosted and Dedicated VCO were also affected but have already been patched by Arista; only on-premises deployments require customer action. |
What does this mean for affected devices?
CVE-2026-114625 is a SQL injection vulnerability (CWE-89) in the on-premises Arista VeloCloud Orchestrator (VCO). NVD's description, drawn from Arista's own CVE record, states: "any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user," adding that "this includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible" (NVD).
NVD lists the CVE as "Analyzed" and records Arista's own CVSS v3.1 submission of 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, alongside a CVSS v4.0 score of 9.4 (NVD).
Arista's Security Advisory 0199, published 2026-10-22, states the issue affects on-premises VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12 (Hosted and Dedicated VCO were already patched), confirms the vulnerability "is known to be actively exploited," and recommends restricting web-interface access to trusted networks and watching for connections from the attacker IP addresses it lists as indicators of compromise (Arista Security Advisory 0199).
CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-23, one day after publication, with a required-action due date of 2026-10-26 and ransomware use recorded as "Unknown" (CISA KEV).
As of 2026-10-23, FIRST scores the probability of exploitation at 0.00555 (45.586th percentile) (FIRST EPSS).
Because this is a confirmed, actively exploited privilege-escalation flaw in a widely deployed SD-WAN orchestrator, operators running on-premises VCO on an affected version should patch immediately, restrict management-interface exposure to trusted networks, and check for the indicators of compromise Arista published, per CISA's BOD 26-04 forensic-triage guidance.
Evidence
- SQL injection lets any authenticated user gain operator privileges and masquerade as a local superuser operator, reaching internal-only functionality on the on-premises VCO. — NVD
- CVSS v3.1 base score is 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and CVSS v4.0 score is 9.4, per Arista's own CVSS submission as recorded by NVD (status: Analyzed). — NVD
- Affects on-premises VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12 (Hosted/Dedicated already patched); confirmed actively exploited; indicators of compromise and mitigations published. — Arista Security Advisory 0199
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-23, due date 2026-10-26, known ransomware use recorded as "Unknown". — CISA KEV
- EPSS score is 0.00555 (45.586th percentile) as of 2026-10-23. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
Does an attacker need admin privileges to exploit CVE-2026-114625?
No — NVD's description, drawn from Arista's own CVE record, states that any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user, reaching internal-only functionality that isn't meant to be remotely accessible (per NVD).
Do all Arista VeloCloud Orchestrator deployments need customer action to fix CVE-2026-114625?
No — only on-premises deployments require customer action; Hosted and Dedicated VCO were also affected but Arista had already patched them before the advisory was published (per Arista Security Advisory 0199).
Has CVE-2026-114625 actually been exploited, or is it a theoretical SQL injection?
Arista's advisory confirms the vulnerability "is known to be actively exploited," and CISA added it to the Known Exploited Vulnerabilities catalog just one day after publication, on 2026-10-23 (per Arista Security Advisory 0199; per CISA KEV).
What fixed versions should an on-premises VCO operator upgrade to?
The fix depends on the branch: 5.2.3.18 for the 5.2.x line, 6.1.3.10 for the 6.1.x line, and 6.4.2.12 for the 6.4.x line (per Arista Security Advisory 0199).
Questions about this page?