Arista says VeloCloud Orchestrator flaw is being actively exploited
CVE-2026-114625 (CVSS 9.9) in on-prem VeloCloud Orchestrator lets any authenticated user gain operator privileges. Fixes are in 5.2.3.18, 6.1.3.10 and 6.4.2.12.
Arista published Security Advisory 0199 on 22 October for CVE-2026-114625, an SQL injection issue in on-prem VeloCloud Orchestrator (VCO) rated 9.9 under CVSS 3.1. Arista detected the issue and says it is known to be actively exploited.
On an affected system, any authenticated user, down to the lowest built-in Enterprise Read Only role, can gain operator privileges and act as a local superuser operator, including access to internal-only functionality. Arista says VCO is exposed by default and no configuration prevents the exposure.
Affected and fixed versions
VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12 are affected. Hosted and Dedicated VCO instances have already been patched. Arista's EOS products and VeloCloud Gateway and Edge are not affected.
Arista recommends upgrading to a fixed release. Until then, it advises restricting access to the VCO web interface to trusted networks and reviewing logs. It lists two IP addresses observed in the attacks: 74.82.197.86 and 38.54.50.151.