Overview
CVE-2026-114625 is a critical SQL injection vulnerability in Arista VeloCloud Orchestrator (VCO) On-Prem. Arista rates it CVSS v3.1 9.9 and CVSS v4.0 9.4. Any authenticated user can escalate to operator privileges and masquerade as a local "superuser operator", compromising the confidentiality, integrity and availability of the orchestrator and the data it manages.
Arista published Security Advisory 0199 on October 22, 2026 and confirmed active exploitation. CISA added the flaw to its KEV catalog on October 23, 2026. Press coverage describes it as the third exploited VCO flaw in four months.
Affected Products
| Release Train | Affected | Fixed |
|---|---|---|
| VCO On-Prem 5.2.x | Before 5.2.3.18 | 5.2.3.18 |
| VCO On-Prem 6.1.x | Before 6.1.3.10 | 6.1.3.10 |
| VCO On-Prem 6.4.x | Before 6.4.2.12 | 6.4.2.12 |
Hosted and Dedicated VCO deployments were affected but have already been patched by Arista. VeloCloud Gateway and Edge are not affected.
Technical Details
- Exploitation needs network access to the VCO web interface and a valid session.
- The lowest built-in tenant role, Enterprise Read Only, is enough.
- Arista states no configuration change prevents the exposure, so patching is the only complete fix.
Mitigation
- Upgrade on-prem VCO to 5.2.3.18, 6.1.3.10 or 6.4.2.12.
- Contact Arista TAC if you run an unsupported release train.
- Restrict the VCO web interface to trusted administrative networks.
- Review VCO audit logs for unexpected role changes or operator-level actions by read-only accounts, and audit tenant accounts for ones you do not recognize.