CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Arista VeloCloud Orchestrator On-Prem: SQL injection lets any authenticated user, down to Enterprise Read Only, act as superuser operator; Arista says it is actively exploited (CVSS 3.1 9.9); fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12

cve · CVE-2026-114625 single-source

Coverage
1
first 2026-10-23 → last 2026-10-23
Latest activity
2026-10-23
Arista confirms exploitation of a VeloCloud Orchestrator flaw: any tenant login, even read-only, reaches…
Peak priority
high
1 high
Targets
·
no sector or region stated
Sources cited
2
1 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-114625, newest first. Check the date before acting on an older one.

  • Upgrade every on-premises VeloCloud Orchestrator to 5.2.3.18, 6.1.3.10 or 6.4.2.12 (or later in its train) now and, until then, restrict its web interface to trusted administrative networks; before upgrading, preserve the web access, application, system and database logs and the file-system timestamps, then check the host for backdoor daemons, web shells and unexpected outbound traffic.
    2026-10-23CVE-2026-114625

Defender insights

What each entry about CVE-2026-114625 tells a defender to do, newest first.

2026-10-23HIGHexploitedArista confirms exploitation of a VeloCloud Orchestrator flaw: any tenant login, even read-only, reaches operator rights

Exposure · triage · detection

Story timeline

  1. 2026-10-23CVE-2026-114625, Arista VeloCloud Orchestrator On-Prem: an SQL injection lets any authenticated user, down to the Enterprise Read Only role, act as a superuser operator, and Arista says it is actively exploited (CVSS 3.1 9.9)
    trending-vulnerabilitiesArista confirms exploitation of a VeloCloud Orchestrator flaw: any tenant login, even read-only, reaches operator rights

Hunting pivots

Affected products
Arista VeloCloud Orchestrator On-Prem
Tags
actively-exploitedpatch-availablepriv-escsqlivulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Privilege EscalationExploitation for Privilege Escalation

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-23/cve-2026-114625-arista-velocloud-orchestrator-sqli-exploited · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-10-23/cve-2026-114625-arista-velocloud-orchestrator-sqli-exploited · ATT&CK page ↗

Entries about Arista VeloCloud Orchestrator On-Prem: SQL injection lets any authenticated user, down to Enterprise Read Only, act as superuser operator; Arista says it is actively exploited (CVSS 3.1 9.9); fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12 (1)

2026-10-23 · view entry permalink →

HIGHCVE-2026-114625exploitedNATOA2

CVE-2026-114625, Arista VeloCloud Orchestrator On-Prem: an SQL injection lets any authenticated user, down to the Enterprise Read Only role, act as a superuser operator, and Arista says it is actively exploited (CVSS 3.1 9.9)

Arista's Security Advisory 0199 of 2026-10-22 covers CVE-2026-114625 (CVSS 3.1 9.9, CVSS 4.0 9.4, CWE-89 SQL injection) in the on-premises VeloCloud Orchestrator (VCO): on an affected system any authenticated user can gain operator privileges and masquerade as a local "superuser operator", which includes access to functionality intended for internal use only and not for remote access (Arista Networks, 2026-10-22). Arista states that it detected the issue and that it is known to be actively exploited, and the advisory names no actor, victim count or start date (Arista Networks, 2026-10-22). The prerequisite is network access to the VCO web interface and a valid session on the VCO portal; the lowest role that suffices is Enterprise Read Only, the lowest built-in tenant role, the interface is exposed by default and no configuration prevents the exposure (Arista Networks, 2026-10-22).

Affected are VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12, and end-of-support releases were not assessed; hosted and dedicated VCO were affected and are already patched, while VeloCloud Gateway and VeloCloud Edge are not affected (Arista Networks, 2026-10-22). Arista's recommended resolution is the upgrade, and for an unsupported release train it points customers to its support centre to discuss upgrade options (Arista Networks, 2026-10-22); its CSAF file records the CVSS 3.1 score and the same interim measures, and describes the flaw as "VeloCloud Orchestrator Remote Code Execution (VCO RCE)" where the advisory page names an SQL injection that grants operator privileges; Arista does not say how the two descriptions relate (Arista Networks CSAF, 2026-10-22).

Triage: a session authenticated as a low-privilege tenant account, Enterprise Read Only above all, that reaches operator-only or internal-only functions is the signal, because legitimate operators act from their own accounts; Arista lists attacker source addresses in its advisory (Arista Networks, 2026-10-22).

This issue was detected by Arista and is known to be actively exploited.

On an affected system, any authenticated user can gain operator privileges and masquerade as a local “superuser operator” user.

A successful attack requires network access to the VCO web interface and a valid authenticated session on the VCO portal.

Arista Networks (Security Advisory 0199) 2026-10-22

Builds on: Arista confirms exploitation of an SD-WAN orchestrator flaw that has no patch for two of its… · Arista patches an actively exploited unauthenticated command-injection flaw in on-prem…

vulnerability23 Oct 03:31Zsingle-sourceOpen finding →
Sources: Arista Networks (Security Advisory 0199) · Arista Networks (CSAF for Security Advisory 0199)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • arista.com2 (100%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)