Arista VeloCloud Orchestrator SQL injection CVE-2026-114625 exploited; update on-prem VCO
Arista's on-premises VeloCloud Orchestrator has a critical SQL injection flaw (CVE-2026-114625) that attackers are exploiting. Fixes are out: 5.2.3.18, 6.1.3.10 or 6.4.2.12. If you run it, update and limit who can reach its web interface.
If your organisation runs its own VeloCloud Orchestrator, ask your IT team or network provider to update to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later, and to limit web access to trusted admin networks. Home users have nothing to do.
What’s happening
Arista disclosed CVE-2026-114625 on 22 October 2026. It is a SQL injection flaw in the web interface of on-premises VeloCloud Orchestrator (VCO), the software that manages VeloCloud SD-WAN networks. Arista rates it critical (CVSS 3.1 score 9.9). Arista says an attacker with any valid login, even the lowest Enterprise Read Only role, can gain operator privileges and impersonate a local superuser operator, reaching internal-only functions. That can compromise the orchestrator and the data it manages. The exposure is on by default. Arista says it detected the flaw being exploited in attacks and published two attacker IP addresses. CISA added it to its list of exploited flaws on 23 October. Fixed versions are 5.2.3.18, 6.1.3.10 and 6.4.2.12, or later in each train. Arista says its Hosted and Dedicated VCO services were already patched. End-of-support versions were not assessed. As of 3 November no newer development has been found. Arista's other products are not affected.
- What
- Flaw
- Affects
- Arista VeloCloud Orchestrator (on-premises)
- Affected
- VeloCloud Orchestrator on-prem 5.2.x before 5.2.3.18
VeloCloud Orchestrator on-prem 6.1.x before 6.1.3.10
VeloCloud Orchestrator on-prem 6.4.x before 6.4.2.12 - Fixed in
- 5.2.3.18
6.1.3.10
6.4.2.12 - Since
- 22 Oct 2026
Timeline
- Update
BleepingComputer reported it as another exploited VeloCloud Orchestrator zero-day among several Arista flaws exploited in 2026, and repeated Arista's advice to restrict web access and block the two attacker IPs.
- New fixFixed
Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12 (and later in each train). Arista said Hosted and Dedicated VCO deployments were already patched, and told customers on unsupported release trains to contact Arista TAC.
- Made publicFixed
Arista published Security Advisory 0199 for CVE-2026-114625, a critical SQL injection in on-premises VeloCloud Orchestrator (CVSS 3.1 score 9.9). Arista said it is known to be actively exploited and named two attacker IP addresses.
Sources
- Security Advisory 0199: VeloCloud Orchestrator On-PremArista · 22 Oct 2026
- Arista patches new VeloCloud Orchestrator zero-day exploited in attacksBleepingComputer · 22 Oct 2026