CVE-2026-114625: VeloCloud Orchestrator SQL Injection
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-23. Federal agencies must patch by 2026-10-26.
TL;DR - CVE-2026-114625 is a critical vulnerability in on-premises Arista VeloCloud Orchestrator (VCO) that can allow an authenticated user to gain superuser-operator privileges. - Affected 5.2.x, 6.1.x, and 6.4.x releases require branch-specific upgrades. - CISA confirmed exploitation in the wild and set a remediation due date of October 26, 2026. - Upgrade to VCO 5.2.3.18+, 6.1.3.10+, or 6.4.2.12+, as applicable.
CVE-2026-114625 is a critical VeloCloud Orchestrator vulnerability involving SQL injection and authenticated privilege escalation. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on October 23, 2026, so organizations should prioritize patching and investigate potentially exposed systems immediately.
Vulnerability at a Glance
CVE-2026-114625 affects Arista VeloCloud Orchestrator On-Prem. CISA classifies the issue as an SQL injection vulnerability, while available technical descriptions emphasize authenticated privilege escalation, impersonation of a local “superuser operator,” and access to internal functionality.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-114625 |
| Product | Arista VeloCloud Orchestrator On-Prem |
| Severity | Critical |
| CVSS v3 base score | 9.9 |
| CVSS vector | Not published in the supplied research material; obtain it from NVD or Arista before quoting it |
| Attack vector | Remote access to the affected VCO service is possible; exact CVSS vector details are unavailable |
| Authentication | An authenticated user is required |
| Privilege impact | The user can escalate privileges and masquerade as a local superuser operator |
| Patch available | Yes |
| Exploitation status | Confirmed in the wild through CISA KEV |
| CISA KEV date added | October 23, 2026 |
| CISA remediation due date | October 26, 2026 |
The 9.9 CVSS score and KEV listing make this an emergency remediation issue. An authentication requirement remains serious when VCO is reachable by untrusted users, compromised accounts, delegated operators, or internet-based attack paths.
Analyst’s Take: Patch priority should be driven by confirmed exploitation, not by the missing CVSS vector or the absence of a public exploit signature. The authentication requirement matters for investigation, but it does not justify delaying upgrades on reachable VCO systems.
What Is CVE-2026-114625?
CVE-2026-114625 allows an authenticated user on an affected VCO deployment to obtain operator privileges and masquerade as a local “superuser operator” account. That identity is intended to access privileged internal functionality that should not be remotely available to ordinary users.
CISA and NVD identify the vulnerability as SQL injection, but available primary-source material does not disclose the vulnerable query, endpoint, parameter, code path, database operation, or weakness mapping. Defenders should avoid assuming a specific URL, request body, or SQL payload when building detections. The confirmed behavior is privilege escalation followed by unauthorized access to internal functionality.
Successful exploitation can affect the confidentiality, integrity, and availability of the VCO host and data managed through the orchestrator. Depending on deployment architecture and account privileges, an attacker may be able to alter administrative state, access sensitive configuration information, or interfere with orchestration operations.
Technical Notes
The available evidence supports this attack sequence:
- An attacker obtains or uses valid credentials for an account on the affected VCO system.
- The attacker reaches vulnerable application functionality.
- The vulnerability enables privilege escalation or impersonation of a local “superuser operator.”
- The attacker invokes privileged internal functionality.
- The VCO host or orchestrated environment may be affected.
No public vendor detail currently establishes the exact SQL injection sink or a reliable network signature. Security teams should not treat the absence of a known payload as evidence that exploitation did not occur.
Who Is Affected?
The affected platform is VeloCloud Orchestrator On-Prem, formerly referred to as VeloCloud Orchestrator by Broadcom. Arista Security Advisory 0199 identifies these affected release ranges:
| Product branch | Affected versions | Fixed version |
|---|---|---|
| VCO 5.2.x | Releases prior to 5.2.3.18 | 5.2.3.18 or later |
| VCO 6.1.x | Releases prior to 6.1.3.10 | 6.1.3.10 or later |
| VCO 6.4.x | Releases prior to 6.4.2.12 | 6.4.2.12 or later |
Inventory every on-premises VCO instance, including disaster-recovery systems, dormant appliances, test environments, and systems managed by third parties. Treat a deployment as affected if its exact version cannot be verified against the fixed releases.
Arista states that hosted VCO deployments, including Dedicated versions, were impacted and have already been patched. The advisory’s affected-software list focuses on on-premises releases. End-of-support software versions were not assessed, so unsupported installations must not be assumed safe merely because they fall outside the listed branches.
Organizations that need to review related identity and privilege risks may also benefit from this guide to what a non-human identity is, particularly where VCO automation accounts are involved.
CVSS Score Breakdown
CVE-2026-114625 has a reported CVSS v3 base score of 9.9, rated Critical. The supplied NVD information does not include the vector string, so individual metric values cannot be stated reliably. Before publishing or operationalizing a metric-by-metric interpretation, obtain the current vector from the NVD record or Arista Security Advisory 0199.
The available description still establishes important risk characteristics. Exploitation requires an authenticated user, but the resulting privilege escalation allows the attacker to impersonate a highly privileged local operator and reach internal functionality. The potential impact spans confidentiality, integrity, and availability, which is consistent with the very high base score.
| CVSS consideration | Confirmed information |
|---|---|
| Authentication | An authenticated user is required |
| Privilege impact | The user can gain operator privileges and masquerade as a superuser operator |
| Confidentiality | Potentially affected |
| Integrity | Potentially affected |
| Availability | Potentially affected |
| Exact vector | Unknown from the supplied source material |
The missing vector is a documentation limitation, not a reason to downgrade operational priority. CISA’s KEV listing independently confirms that exploitation has occurred and establishes an immediate remediation expectation.
Exploitation Status
Exploitation in the wild is confirmed. CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities catalog on October 23, 2026, with a remediation due date of October 26, 2026. Assume that exposed and reachable VCO systems are being actively targeted, even if local telemetry does not yet show suspicious activity.
No public proof-of-concept repository or issue was identified in the supplied research. The absence of a public PoC is not meaningful risk reduction because KEV inclusion confirms real-world exploitation. CISA records ransomware campaign use as unknown; there is no basis to claim that a ransomware operation is associated with this CVE.
The authentication prerequisite should guide investigation rather than delay patching. Review accounts with access to VCO, recently created or modified users, unusual login locations, credential reuse, and activity involving operator or superuser identities. Investigate systems where the VCO service is exposed to the internet or reachable from broad user, partner, or management networks.
Upgrade and Verification Checklist
Use the following checklist to track remediation:
- Identify every VCO On-Prem deployment.
- Record the exact VCO branch and patch level.
- Identify internet-facing and broadly reachable management interfaces.
- Review privileged users, recent account changes, and unusual authentication activity.
- Back up the deployment according to Arista’s guidance.
- Upgrade to the fixed release for the installed branch.
- Confirm the running version after the upgrade.
- Review logs for suspicious privilege escalation or superuser impersonation.
- Rotate credentials if compromise is suspected.
- Close the remediation record only after technical verification.
A generic inventory record can be maintained as follows:
hostname,management_ip,vco_version,exposure,owner,upgrade_status
vco-prod-01,10.10.20.15,6.1.x,restricted,network-team,pending
The required remediation decision can be represented operationally as:
if version < 5.2.3.18 on 5.2.x: upgrade to 5.2.3.18+
if version < 6.1.3.10 on 6.1.x: upgrade to 6.1.3.10+
if version < 6.4.2.12 on 6.4.x: upgrade to 6.4.2.12+
if unsupported or unknown: contact Arista and treat as vulnerable
How to Detect CVE-2026-114625 Exploitation
Detection should combine version inventory, authentication telemetry, authorization changes, administrative audit logs, and network exposure data. First identify all VCO On-Prem systems and record their exact branch and patch level. Escalate any instance below 5.2.3.18, 6.1.3.10, or 6.4.2.12, as applicable.
The supplied advisory does not provide a confirmed exploit signature, vulnerable endpoint, SQL error pattern, or forensic artifact. Focus instead on behavioral indicators:
- Successful logins from unusual sources
- Privilege or role changes
- Use of superuser-operator identities
- Access to functions normally unavailable to the account
- Administrative activity outside expected change windows
- New or modified accounts with elevated privileges
- VCO management access from untrusted or unexpected networks
SIEM Query Example
A generic SIEM query can identify suspicious privilege and identity events if VCO logs are normalized into fields such as product, event_type, user, source_ip, and target_role:
product="VeloCloud Orchestrator"
AND (
event_type IN ("privilege_change", "role_change", "impersonation", "internal_function_access")
OR target_role IN ("superuser", "superuser operator", "operator")
)
If raw logs are available, search for records containing terms associated with the affected behavior:
grep -Eai \
'superuser[[:space:]_-]*operator|impersonat|privilege|role.?change|internal.*function|sql|syntax error|union[[:space:]]+select' \
/var/log/velocloud/* /var/log/* 2>/dev/null
This is a triage pattern, not a validated exploit signature. SQL-related strings may produce false positives, and the absence of SQL error messages does not exclude exploitation. Correlate matches with source IP, account, timestamp, login event, administrative changes, and the VCO version.
Network teams should identify internet-facing VCO management interfaces and restrict access to trusted administrative networks. Since the exact vulnerable endpoint is unavailable, broad exposure reduction is more dependable than filtering a presumed request path.
Mitigation and Patching
Upgrade affected on-premises installations to the corresponding fixed release:
- Upgrade VCO 5.2.x releases below 5.2.3.18 to 5.2.3.18 or later.
- Upgrade VCO 6.1.x releases below 6.1.3.10 to 6.1.3.10 or later.
- Upgrade VCO 6.4.x releases below 6.4.2.12 to 6.4.2.12 or later.
Use the upgrade mechanism documented for the installed VCO release and deployment architecture. The supplied material does not identify a universal package name, repository, or supported CLI syntax, so administrators should not run an unverified generic command. A safe operational workflow is to obtain the appropriate image or upgrade package from Arista, validate its integrity according to vendor instructions, back up the deployment, test the upgrade procedure where possible, and confirm the running version after completion.
Temporary Risk Reduction
No separate workaround was available in the retrieved advisory content. If immediate upgrading is impossible, apply Arista’s current mitigation instructions directly from Security Advisory 0199.
Until the vendor-approved mitigation or upgrade is complete:
- Restrict VCO access to trusted management networks.
- Remove unnecessary internet exposure.
- Enforce strong authentication and review privileged accounts.
- Disable unused accounts and remove excess permissions.
- Monitor all administrative activity.
- Preserve relevant authentication and audit logs.
- Document compensating controls and an explicit upgrade deadline.
These measures reduce exposure but should not be treated as a substitute for patching. For broader access-control planning, see this practitioner’s definition of just-enough access.
CISA assigned October 26, 2026, as the remediation due date. Suspected exploitation warrants credential review, preservation of logs and system images, containment where appropriate, and forensic analysis using CISA’s applicable Forensics Triage Requirements.
References
- Arista Security Advisory 0199
- NVD: CVE-2026-114625
- CISA Known Exploited Vulnerabilities Catalog: CVE-2026-114625
Arista’s advisory should be treated as the authoritative source for upgrade procedures and deployment-specific mitigation. Consult the NVD record for the latest CVSS vector and metadata. CISA’s KEV entry establishes the confirmed exploitation status and remediation urgency.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.