CVE-2026-114625
Arista VeloCloud Orchestrator SQL Injection Vulnerability
Arista VeloCloud OrchestratorNetwork & edge
CVSS
9.9CriticalExploit odds (EPSS)0.56%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV
Patching is not enoughCISA requires federal agencies to look for signs of compromise on affected systems, not only patch (forensic triage under BOD 26-04). Treat exposed systems as possibly compromised. CISA guidance
What fixes it
- 5.2.3.18VeloCloud OrchestratorCVE List
- 6.1.3.10VeloCloud OrchestratorCVE List
- 6.4.2.12VeloCloud OrchestratorCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
- 22 Oct 2026, 15:25 UTCFirst reported exploitedBluesky: exploited in the wild
- 22 Oct 2026, 20:47 UTCPublishedCVE List
- 23 Oct 2026Added to CISA KEVCISA KEV
Vendor and government advisories 1
Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.
Reports 26
5 outlets report exploitation. Reports are not confirmation; each links to its source.
- @theperimetersite.bsky.social: The federal deadline to patch CVE-2026-114625 is October 26. If you're managing Arista VeloCloud Orchestrators, you've got about 48 hours (hardly any time at all) to stop an activeBluesky: zero-day, 24 Oct 2026
- @newssecia.bsky.social: 🤖 CISA KEV, Oct 23: two flaws under active exploitation — CVE-2026-110447 (CVSS 9.2), OS command injection in Collabora Online CODE Server, and CVE-2026-114625, SQLi in Arista VeloBluesky: CVE posts, 24 Oct 2026Exploitation reported
- @0daynews.bsky.social: collabora CVE-2026-110447 and arista-velocloud CVE-2026-114625 confirmed exploited, cisa KEV patch by oct 26. #infosec https://0daynews.com/articles/2026-10-24-cisa-kev-collabora-vBluesky: CVE posts, 24 Oct 2026
- @undercodenews.bsky.social: CISA Sounds the Alarm on Critical Arista VeloCloud Flaw as Attackers Exploit CVE-2026-114625 + Video A Critical Vulnerability Puts Enterprise Network Management at Risk A critical Bluesky: CVE posts, 24 Oct 2026Exploitation reported
- @newssecia.bsky.social: 🤖 CISA KEV (due Oct 26): CVE-2026-110447 (CVSS 9.2) command injection → RCE in Collabora CODE Server on Nextcloud; CVE-2026-114625 SQL injection in on-prem Arista VeloCloud OrchestBluesky: CVE posts, 24 Oct 2026Exploitation reported
- @securityrss.bsky.social: Attackers are exploiting a zero-day SQL injection vulnerability (CVE-2026-114625) in Arista's VeloCloud Orchestrator, allowing users with read-only accounts to gain full operator pBluesky: CVE posts, 24 Oct 2026Exploitation reportedZero-day
- @cybersecurity.poliverso.org.ap.brid.gy: U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and InfrBluesky: CVE posts, 24 Oct 2026Exploitation reported
- @hendryadrian.bsky.social: CISA added CVE-2026-114625, an Arista VeloCloud Orchestrator SQL injection flaw, to its KEV Catalog based on evidence of active exploitation and urged organizations to prioritize rBluesky: CVE posts, 24 Oct 2026
- 🚨 CVE-2026-114625 VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. SuccessfulTelegram: CVE Notify, 24 Oct 2026
- @unnchain.bsky.social: SD-WAN管理ツール VeloCloud Orchestrator オンプレ版の脆弱性 CVE-2026-114625（CVSS 9.9）が攻撃に悪用されています。 閲覧専用の最低権限アカウントでも、SQLインジェクションで特権機能に入り込めます。クラウド提供版は修正済み。 5.2.3.18／6.1.3.10／6.4.2.12以降へ更新を。それまで管理画面Bluesky: CVE posts, 23 Oct 2026
Description
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Text from CVE List
Affected versions 3
- VeloCloud Orchestratoraffected: 5.2.0 before 5.2.3.18CVE List
- VeloCloud Orchestratoraffected: 6.1.0 before 6.1.3.10CVE List
- VeloCloud Orchestratoraffected: 6.4.0 before 6.4.2.12CVE List