CVE-2026-114625: Arista VeloCloud Orchestrator SQLi (KEV)

CVE-2026-114625 is a SQL injection vulnerability in the on-premises Arista VeloCloud Orchestrator that lets any authenticated user execute crafted database operations to gain operator-level privileges and masquerade as a local superuser operator, reaching internal-only functionality; Arista confirms active exploitation and CISA added it to KEV the day after publication.

CVE-2026-114625 is a SQL injection vulnerability (CWE-89) in the on-premises Arista VeloCloud Orchestrator (VCO). NVD's description, drawn from Arista's own CVE record, states: "any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user," adding that "this includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible" (NVD).

NVD lists the CVE as "Analyzed" and records Arista's own CVSS v3.1 submission of 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, alongside a CVSS v4.0 score of 9.4 (NVD).

Arista's Security Advisory 0199, published 2026-10-22, states the issue affects on-premises VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12 (Hosted and Dedicated VCO were already patched), confirms the vulnerability "is known to be actively exploited," and recommends restricting web-interface access to trusted networks and watching for connections from the attacker IP addresses it lists as indicators of compromise (Arista Security Advisory 0199).

CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-23, one day after publication, with a required-action due date of 2026-10-26 and ransomware use recorded as "Unknown" (CISA KEV).

As of 2026-10-23, FIRST scores the probability of exploitation at 0.00555 (45.586th percentile) (FIRST EPSS).

Because this is a confirmed, actively exploited privilege-escalation flaw in a widely deployed SD-WAN orchestrator, operators running on-premises VCO on an affected version should patch immediately, restrict management-interface exposure to trusted networks, and check for the indicators of compromise Arista published, per CISA's BOD 26-04 forensic-triage guidance.

• SQL injection lets any authenticated user gain operator privileges and masquerade as a local superuser operator, reaching internal-only functionality on the on-premises VCO. — NVD
• CVSS v3.1 base score is 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and CVSS v4.0 score is 9.4, per Arista's own CVSS submission as recorded by NVD (status: Analyzed). — NVD
• Affects on-premises VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12 (Hosted/Dedicated already patched); confirmed actively exploited; indicators of compromise and mitigations published. — Arista Security Advisory 0199
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-23, due date 2026-10-26, known ransomware use recorded as "Unknown". — CISA KEV
• EPSS score is 0.00555 (45.586th percentile) as of 2026-10-23. — FIRST EPSS