CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Details
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XFrequently asked questions
Is CVE-2026-114625 being actively exploited?
Yes — CISA lists CVE-2026-114625 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.
What does CVE-2026-114625 affect?
CVE-2026-114625 affects Arista · VeloCloud Orchestrator.
How do I fix CVE-2026-114625?
Apply the vendor’s patch for the affected software. The federal patch deadline was Oct 26, 2026. Then check whether your personal data was exposed in any related breach.