CVE-2026-114625CVSS 9.9Authenticated SQL injection
Even an Enterprise Read Only user can gain superuser operator privileges.
Arista confirms active exploitation of VeloCloud Orchestrator SQL injection
CVE-2026-114625 lets an authenticated VeloCloud Orchestrator user gain operator privileges. Arista confirms attacks; hosted instances are patched, while on-premises operators must upgrade.
- Disclosed
- Oct 22, 2026
- Updated Oct 23, 2026
- Severity
- CVSS 9.9
- 1 CVE tracked here
- Splash zone
- Web-reachable VCO below the listed fixes plus a valid portal session; Enterprise Read Only is sufficient
- velocloud
- In the wild
- Yes
- Arista confirms exploitation; CISA added it to KEV on October 23
What happened
L4: confirmed exploitation of the SD-WAN management plane. Access requires a portal session and network reachability. Hosted and Dedicated VCO are already patched; Gateway and Edge are not affected by this flaw.
The score is CVSS 3.1; Arista also assigns CVSS 4.0 9.4. Victim totals and attack start dates are undisclosed. Patching does not establish that an already compromised host is clean. Four-component vendor versions are preserved without an interactive checker.
October 23: CISA added this CVE to its Known Exploited Vulnerabilities catalog, with an October 26 remediation due date and forensic triage flagged. The federal requirement is separate from the vendor’s advice to all operators to patch promptly. This corroborates the already confirmed attacks; no new victim count is established.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| VCO 5.2 | 5.2.3.18 | |
| VCO 6.1 | 6.1.3.10 | |
| VCO 6.4 | 6.4.2.12 |
Crime-scene timeline
Oct 22, 2026
Arista discloses exploitation and fixes
Oct 23, 2026
CISA adds the vulnerability to KEV
The entry flags forensic triage and gives October 26 as the federal remediation due date.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Arista security advisory 0199Primary
- CISA KEV catalog, October 23PrimaryCVE-2026-114625 added October 23; due October 26; forensic triage flagged