CVE-2026-114625
SQL injection lets authenticated users gain operator privileges in VeloCloud Orchestrator
VeloCloud Orchestrator on-premises has a critical SQL injection flaw, meaning an attacker can send malicious database commands; an authenticated user can use it to gain operator privileges and access internal-only functionality. Arista has fixed it in the listed releases, hosted and dedicated versions were already patched, and CISA says it is actively exploited and has added it to its known-exploited list.
Arista VeloCloud Orchestrator · Updated 28 Oct · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 23 Oct; US agencies must fix by 26 Oct
SeveritycriticalCVSS 9.4 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| VeloCloud Orchestrator 6.4 | 6.4.2.12 |
| VeloCloud Orchestrator 6.1 | 6.1.3.10 |
| VeloCloud Orchestrator 5.2 | 5.2.3.18 |
What to do
- Upgrade on-premises VeloCloud Orchestrator to the fixed release for your branch: 6.4.2.12, 6.1.3.10, or 5.2.3.18.
- If you are a US federal agency, apply the fix by 2026-10-26 as CISA directs.
- If you use hosted or dedicated VCO, confirm with Arista that the service is already patched.
What happened
- 22 OctArista releases security updates for an actively exploited zero-day vulnerability in VeloCloud Orchestrator on-premises.
- 23 OctCISA adds CVE-2026-114625 to its Known Exploited Vulnerabilities catalog and says it is actively exploited.
- 26 OctCISA says US federal agencies must fix the vulnerability by this date.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-114625 | Security Advisory 0199 | critical 9.4 | 23 Oct | 1.0% |
Our reporting
22 OctArista patches actively exploited zero-day in VeloCloud OrchestratorReported elsewhere
CISA · 23 OctCISA Adds One Known Exploited Vulnerability to Catalog ↗The records
arista.com: advisory ↗CISA known-exploited catalog ↗CVE-2026-114625 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works