Arista says CVE-2026-114625, a CVSS 9.9 SQL injection in VeloCloud Orchestrator On-Prem, is exploited. Any login, even read-only, reaches superuser.
Arista has disclosed another actively exploited flaw in VeloCloud Orchestrator (VCO) On-Prem, the management plane for its VeloCloud SD-WAN estates. CVE-2026-114625, published in Security Advisory 0199 on 22 October 2026, is a SQL injection (CWE-89) that lets any authenticated user become a "superuser operator". Arista scores it CVSS 9.9 (v3.1) and 9.4 (v4.0). The advisory says the issue was detected by Arista and is known to be actively exploited. It gives no attribution, no start date for the attacks, and no count of affected customers.
Hosted and Dedicated VCO instances were affected too, but Arista says they are already patched. The people who have work to do are those who run VCO On-Prem.
Who is affected
The advisory lists three release trains, each fixed in a specific build:
| Train | Affected | Fixed |
|---|---|---|
| 5.2.x | before 5.2.3.18 | 5.2.3.18 and later |
| 6.1.x | before 6.1.3.10 | 6.1.3.10 and later |
| 6.4.x | before 6.4.2.12 | 6.4.2.12 and later |
Arista did not assess end-of-support versions and tells customers on unsupported trains to contact TAC about upgrade options. The advisory does not mention the 7.0 train at all, so a 7.0 operator should ask Arista directly instead of assuming either way. VeloCloud Gateway and VeloCloud Edge are listed as not affected.
Why the bar to exploit is low
How CVE-2026-114625 is used: any tenant login, even Enterprise Read Only, reaches superuser operator. Source: Arista Security Advisory 0199.
This is not a pre-authentication bug. Arista's description is that any authenticated user can gain operator privileges and masquerade as a local "superuser operator", which opens functionality "intended for internal use only." The attacker needs network access to the VCO web interface and a valid session. The lowest built-in tenant role, Enterprise Read Only, is enough.
That matters because an orchestrator typically holds many tenant and customer logins that were never meant to carry administrative weight. A read-only account from a customer, a contractor or a leaked credential set becomes a route to control of the host. The advisory notes that VCO is exposed by default and that "there is no configuration that can prevent the exposure." The score vectors reflect this: network attack vector, low complexity, low privileges, no user interaction, and a changed scope with high impact on confidentiality, integrity and availability.
NVD published the record on 22 October with Arista as the source and had not yet analysed it; the CVSS scores and CWE-89 are Arista's own. As of the CISA Known Exploited Vulnerabilities feed checked on 23 October (version 2026.10.21), CVE-2026-114625 was not listed. That feed predates the advisory, so check again before relying on it for compliance deadlines.
The third VCO advisory this year
This is a different bug from the one covered in Arista VeloCloud Orchestrator Exploited at CVSS 10.0, With No Fix Listed for Two Release Trains, which concerns CVE-2026-93952 (Advisory 0183, 22 September). It also differs from CVE-2026-16812, an unauthenticated OS command injection in Advisory 0144 (27 July). The three VCO advisories carry different weakness classes (CWE-78, CWE-20 and CWE-89) and different attacker IP addresses, and the Arista pages do not say they are related. Unlike the first two, this one needs a login.
Counting across the product line, Arista's advisories 0137 (CVE-2026-7473, EOS, 5 May), 0144, 0183 and now 0199 all state that the flaw is exploited. That makes this the fourth Arista vulnerability this year that the vendor itself reports as exploited. Advisory 0137 is a moderate-severity EOS tunnel decapsulation issue, so treat "fourth zero-day" as a press framing rather than a like-for-like count of critical VCO bugs.
What defenders should do
- Upgrade On-Prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. Arista offers no workaround that removes the exposure.
- Restrict the VCO web UI to trusted management networks as a stopgap. This narrows who can reach the login page but does not fix the bug, and any credential that works from an allowed network remains useful to an attacker.
- Block and search for the two attacker IPs that Arista published, across proxy, firewall and VCO web logs:
74.82.197.86
38.54.50.151
- Hunt in the web access logs for unusual URL-like path components, encoded characters, references to local or internal services, and high request rates.
- Preserve evidence before you patch or rebuild if you suspect compromise: web access, backend application, system and database logs, plus file-system timestamps. Then contact Arista TAC.
- Look for persistence. Arista advises hunting for backdoor daemons and webshells, auditing recent administrator activity for unexpected changes, and watching the VCO host for unexpected outbound traffic. Block outbound ports that normal operation does not need.
- Review low-privilege accounts. Remove unused Enterprise Read Only users and rotate credentials for accounts you cannot account for, since any one of them is now a path to superuser.
Operators who already patched for the July or September flaws should not assume they are covered: the fixed builds in Advisory 0199 are newer than those named for CVE-2026-16812.
Sources
- Arista Security Advisory 0199 (CVE-2026-114625)
- NVD record for CVE-2026-114625
- CISA Known Exploited Vulnerabilities feed
- BleepingComputer: Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
- Arista Security Advisory 0144 (CVE-2026-16812)
- Arista Security Advisory 0183 (CVE-2026-93952)
- Arista Security Advisory 0137 (CVE-2026-7473)