CVE-2026-114625CVSS 9.9Authenticated SQL injection
Even an Enterprise Read Only user can gain superuser operator privileges.
Arista confirms active exploitation of VeloCloud Orchestrator SQL injection
CVE-2026-114625 lets an authenticated VeloCloud Orchestrator user gain operator privileges. Arista confirms attacks; hosted instances are patched, while on-premises operators must upgrade.
- Disclosed
- Oct 22, 2026
- Public disclosure date
- Severity
- CVSS 9.9
- 1 CVE tracked here
- Splash zone
- VCO 5.2, 6.1 and 6.4 below the listed fixes; unsupported versions are unassessed
- velocloud
- In the wild
- Yes
- Arista advisory 0199 confirms active exploitation
What happened
L4: confirmed exploitation of the SD-WAN management plane. Access requires a portal session and network reachability. Hosted and Dedicated VCO are already patched; Gateway and Edge are not affected by this flaw.
The score is CVSS 3.1; Arista also assigns CVSS 4.0 9.4. Victim totals and attack start dates are undisclosed. Patching does not establish that an already compromised host is clean. Four-component vendor versions are preserved without an interactive checker.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| VCO 5.2 | 5.2.3.18 | |
| VCO 6.1 | 6.1.3.10 | |
| VCO 6.4 | 6.4.2.12 |
Crime-scene timeline
Oct 22, 2026
Arista discloses exploitation and fixes
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.