TL;DR: A SQL injection flaw in on-prem Arista VeloCloud Orchestrator (VCO) lets any logged-in user, even a read-only one, gain operator rights. CVSS 9.9. Arista says it's actively exploited, and CISA added it to KEV on Oct 23. Upgrade to a fixed VCO release. (Arista, CISA KEV)
| Item | Detail | Source |
|---|---|---|
| CVE / severity | CVE-2026-114625, CVSS 9.9 | Arista |
| Affected | VeloCloud Orchestrator, on-prem | Arista |
| Impact | SQL injection; any authenticated user, including read-only, can gain operator rights | Arista |
| Exploitation | Arista says it's actively exploited; CISA KEV add Oct 23 | Arista, CISA KEV |
| Fixed in | VCO 5.2.3.18, 6.1.3.10, 6.4.2.12 | Arista |
What to do
- Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12, whichever matches your release train. (Arista)
- Because read-only accounts are enough, review who has any VCO login.
Last verified 2026-10-23Report an error: [email protected]