2026-10-24
VeloCloud Orchestrator CVE-2026-114625 exploited: fixed versions and what to check
On October 22, 2026, Arista disclosed CVE-2026-114625, a SQL injection vulnerability (CVSS v4.0 9.4, v3.1 9.9) in the on-premises edition of VeloCloud Orchestrator (VCO), its SD-WAN management platform. Arista says it detected the issue and that it is known to be actively exploited. Any authenticated user, down to the lowest built-in tenant role (Enterprise Read Only), can gain operator privileges and masquerade as a local superuser operator. Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12. The advisory says releases not listed are not vulnerable; the 7.0 train is not listed, and no reason is given. Hosted VCO, including Dedicated, has already been patched. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 23 with a due date of October 26. It is the third exploited VCO flaw in three months, after CVE-2026-16812 in July (OS command injection, unauthenticated, CVSS 10.0) and CVE-2026-93952 in September (improper input validation, unauthenticated, CVSS v3.1 10.0). This site's conclusion: organisations running VCO on-prem should move to the latest fixed release on their train today, restrict the management interface to trusted administrative networks, and preserve logs and check for compromise before upgrading.