{"id":"arista-velocloud-orchestrator-sqli-oct-2026","category":"patch","status":"live","title":"Arista VeloCloud Orchestrator SQL injection CVE-2026-114625 exploited; update on-prem VCO","tldr":"Arista's on-premises VeloCloud Orchestrator has a critical SQL injection flaw (CVE-2026-114625) that attackers are exploiting. Fixes are out: 5.2.3.18, 6.1.3.10 or 6.4.2.12. If you run it, update and limit who can reach its web interface.","summary":"Arista disclosed CVE-2026-114625 on 22 October 2026. It is a SQL injection flaw in the web interface of on-premises VeloCloud Orchestrator (VCO), the software that manages VeloCloud SD-WAN networks. Arista rates it critical (CVSS 3.1 score 9.9). Arista says an attacker with any valid login, even the lowest Enterprise Read Only role, can gain operator privileges and impersonate a local superuser operator, reaching internal-only functions. That can compromise the orchestrator and the data it manages. The exposure is on by default. Arista says it detected the flaw being exploited in attacks and published two attacker IP addresses. CISA added it to its list of exploited flaws on 23 October. Fixed versions are 5.2.3.18, 6.1.3.10 and 6.4.2.12, or later in each train. Arista says its Hosted and Dedicated VCO services were already patched. End-of-support versions were not assessed. As of 3 November no newer development has been found. Arista's other products are not affected.","action":"If your organisation runs its own VeloCloud Orchestrator, ask your IT team or network provider to update to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later, and to limit web access to trusted admin networks. Home users have nothing to do.","product":"Arista VeloCloud Orchestrator (on-premises)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-114625"],"tags":["arista","velocloud","sd-wan","sql-injection","exploited","cisa-kev","business"],"affected":["VeloCloud Orchestrator on-prem 5.2.x before 5.2.3.18","VeloCloud Orchestrator on-prem 6.1.x before 6.1.3.10","VeloCloud Orchestrator on-prem 6.4.x before 6.4.2.12"],"fixed":["5.2.3.18","6.1.3.10","6.4.2.12"],"matches":[],"sources":[{"kind":"advisory","title":"Security Advisory 0199: VeloCloud Orchestrator On-Prem","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199","by":"Arista","date":"2026-10-22"},{"kind":"news","title":"Arista patches new VeloCloud Orchestrator zero-day exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/","by":"BleepingComputer","date":"2026-10-22"}],"started":"2026-10-22","closed":null,"created":"2026-11-03T21:53:25.457Z","updated":"2026-11-03T21:53:25.457Z","cve_notes":[{"cve":"CVE-2026-114625","name":"SQL injection in Arista VeloCloud Orchestrator web interface","what":"A SQL injection in the web interface of on-premises VeloCloud Orchestrator that lets a logged-in user, even the lowest read-only role, gain operator privileges, impersonate a superuser and reach internal functions.","severity":"critical","cvss":9.9}],"timeline":[{"at":"2026-10-22","added":"2026-11-03T21:52:22.804Z","kind":"other","text":"BleepingComputer reported it as another exploited VeloCloud Orchestrator zero-day among several Arista flaws exploited in 2026, and repeated Arista's advice to restrict web access and block the two attacker IPs.","url":"https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/","by":"BleepingComputer","patch":null},{"at":"2026-10-22","added":"2026-11-03T21:52:22.804Z","kind":"new-fix","text":"Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12 (and later in each train). Arista said Hosted and Dedicated VCO deployments were already patched, and told customers on unsupported release trains to contact Arista TAC.","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199","by":"Arista","patch":"patched"},{"at":"2026-10-22","added":"2026-11-03T21:52:22.804Z","kind":"disclosed","text":"Arista published Security Advisory 0199 for CVE-2026-114625, a critical SQL injection in on-premises VeloCloud Orchestrator (CVSS 3.1 score 9.9). Arista said it is known to be actively exploited and named two attacker IP addresses.","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199","by":"Arista","patch":"patched"}],"url":"https://hard.fyi/live/arista-velocloud-orchestrator-sqli-oct-2026/","json":"https://hard.fyi/api/live?id=arista-velocloud-orchestrator-sqli-oct-2026"}