Arista VeloCloud Orchestrator on-prem SQL injection (CVE-2026-114625, CVSS 9.4). On CISA's KEV list and actively exploited. Affected versions and next steps.
Arista’s VeloCloud Orchestrator (VCO) has a flaw that lets any authenticated user gain operator privileges. Arista found the issue itself, and its advisory says it is known to be actively exploited. This is not a “look at it later” item. It needs checking today.
Short answer: CVE-2026-114625 affects on-prem VeloCloud Orchestrator (VCO) releases. Anyone who can reach the VCO web interface over the network and holds a valid session, even at the lowest built-in role (Enterprise Read Only), can act as a local “superuser operator.” The CVSS 4.0 score is 9.4 (critical), and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 23, 2026. Upgrade to the fixed releases Arista lists; if you cannot, restrict access to the VCO interface to trusted management networks.
What happened?
SQL injection (CWE-89) happens when an application mixes attacker-supplied text into a database query. If the application passes user input into the query without neutralizing it, the database runs that input as part of the command. The result can be reading, changing, or deleting data. For general application-level defenses, see the PHP security checklist.
According to Arista, this issue affects on-prem VCO. Hosted and Dedicated VCO versions were also affected, but they have already been patched. Arista also states that VCO is exposed by default and that no configuration can prevent that exposure.
CISA added the flaw to KEV on October 23, 2026, with a due date of October 26, 2026. That date has passed. The KEV entry lists known ransomware use as “Unknown.”
Who is affected?
| Attribute | Detail |
|---|---|
| CVE ID | CVE-2026-114625 |
| CVSS score | 9.4 (CVSS 4.0, NVD); 9.9 (CVSS 3.1, Arista advisory) |
| Severity | Critical |
| Weakness type (CWE) | CWE-89: SQL injection |
| Published | October 22, 2026 |
| Added to CISA KEV | October 23, 2026 |
| CISA due date | October 26, 2026 (passed) |
| Affected product | VeloCloud Orchestrator On-Prem |
| Affected versions | 5.2.x before 5.2.3.18; 6.1.x before 6.1.3.10; 6.4.x before 6.4.2.12 |
| Fixed versions | 5.2.3.18, 6.1.3.10, 6.4.2.12 and later |
| Access required | Network access to the VCO web interface and a valid session (minimum role: Enterprise Read Only) |
| Known ransomware use | Unknown |
Arista says it has not assessed end-of-support releases. If you run one, contact Arista TAC about your upgrade options. Arista lists its other products, including EOS-based switches and CloudVision, as not affected.
What should you do?
- Check your version. Find the VCO release in your installation. If you run 5.2.x, 6.1.x, or 6.4.x below the fixed versions above, you are affected.
- Upgrade. Move to a fixed release. Arista recommends upgrading as soon as possible. If you are on an unsupported release, open a TAC request.
- If you cannot upgrade, restrict access. Allow access to the VCO web interface only from trusted administrative networks. It should not stay reachable from the internet.
- Review logs. In VCO web access logs, look for unusual URL path components, encoded characters, references to internal services, and high request rates. Block the two IP addresses Arista lists, 74.82.197.86 and 38.54.50.151, and check whether they appear in your logs.
- If you suspect compromise, preserve evidence first. Keep the VCO web access logs, backend application logs, system logs, database logs, and file timestamps before you clean up. Then check outbound traffic, look for backdoor daemons and webshells, and review recent administrator activity.
Frequently asked questions
Does this affect me?
Yes, if you run on-prem VCO on a release below the fixed versions. Hosted VCO has already been patched. If you only use Arista products that the advisory lists as not affected, this flaw does not apply to you.
The CVSS scores differ (9.4 and 9.9). Which one is right?
Both are correct. They come from different CVSS versions: NVD publishes 9.4 under CVSS 4.0, and Arista’s advisory publishes 9.9 under CVSS 3.1. Both rate the flaw as critical, so the priority does not change.
What if I cannot upgrade right away?
Restrict the VCO interface to trusted management networks, block the listed IP addresses, and monitor the logs. Set a date for the upgrade, and if the fixed release is not available for your version, ask TAC about upgrade paths. If you see anything unusual in the meantime, follow the evidence-preservation steps above.
Sources
- NVD record: CVE-2026-114625
- CISA Known Exploited Vulnerabilities Catalog
- Arista Security Advisory 0199
This article was prepared on November 6, 2026, based on CISA and NVD records. It will be updated if new information emerges. For updates, maintenance, and security work on your servers and applications, use the quote form.