CVE-2026-114625, Arista VeloCloud Orchestrator On-Prem: an SQL injection lets any authenticated user, down to the Enterprise Read Only role, act as a superuser operator, and Arista says it is actively exploited (CVSS 3.1 9.9)
Arista confirms exploitation of a VeloCloud Orchestrator flaw: any tenant login, even read-only, reaches operator rights
Defender actions
- Upgrade every on-premises VeloCloud Orchestrator to 5.2.3.18, 6.1.3.10 or 6.4.2.12 (or later in its train) now and, until then, restrict its web interface to trusted administrative networks; before upgrading, preserve the web access, application, system and database logs and the file-system timestamps, then check the host for backdoor daemons, web shells and unexpected outbound traffic.
Analysis
Arista's Security Advisory 0199 of 2026-10-22 covers CVE-2026-114625 (CVSS 3.1 9.9, CVSS 4.0 9.4, CWE-89 SQL injection) in the on-premises VeloCloud Orchestrator (VCO): on an affected system any authenticated user can gain operator privileges and masquerade as a local "superuser operator", which includes access to functionality intended for internal use only and not for remote access (Arista Networks, 2026-10-22). Arista states that it detected the issue and that it is known to be actively exploited, and the advisory names no actor, victim count or start date (Arista Networks, 2026-10-22). The prerequisite is network access to the VCO web interface and a valid session on the VCO portal; the lowest role that suffices is Enterprise Read Only, the lowest built-in tenant role, the interface is exposed by default and no configuration prevents the exposure (Arista Networks, 2026-10-22).
Affected are VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12, and end-of-support releases were not assessed; hosted and dedicated VCO were affected and are already patched, while VeloCloud Gateway and VeloCloud Edge are not affected (Arista Networks, 2026-10-22). Arista's recommended resolution is the upgrade, and for an unsupported release train it points customers to its support centre to discuss upgrade options (Arista Networks, 2026-10-22); its CSAF file records the CVSS 3.1 score and the same interim measures, and describes the flaw as "VeloCloud Orchestrator Remote Code Execution (VCO RCE)" where the advisory page names an SQL injection that grants operator privileges; Arista does not say how the two descriptions relate (Arista Networks CSAF, 2026-10-22).
Triage: a session authenticated as a low-privilege tenant account, Enterprise Read Only above all, that reaches operator-only or internal-only functions is the signal, because legitimate operators act from their own accounts; Arista lists attacker source addresses in its advisory (Arista Networks, 2026-10-22).
Cited evidence
This issue was detected by Arista and is known to be actively exploited.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local “superuser operator” user.
A successful attack requires network access to the VCO web interface and a valid authenticated session on the VCO portal.
Sources2
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.