CVE-2026-114625
Description
CVE-2026-114625 is a critical (CVSS 9.9) privilege escalation flaw in Arista VeloCloud Orchestrator that is currently being exploited in the wild.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| velocloud_orchestrator | 5.2.0 | 5.2.3.18 | vulnerable |
| velocloud_orchestrator | 6.1.0 | 6.1.3.10 | vulnerable |
| velocloud_orchestrator | 6.4.0 | 6.4.2.12 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Consult Arista Security Advisory 0199 and immediately apply the security updates provided for on-prem VeloCloud Orchestrator (VCO) deployments.
Update affected systems
Upgrade all VCO instances to version 5.2.3.18, 6.1.3.10, or 6.4.2.12 or higher, depending on your current software release branch.
Restrict access
Isolate the VCO management interface from the public internet and restrict access to trusted administrative networks using strict firewall rules or VPNs.
Monitor for exploitation
Audit orchestrator logs for low-privileged users performing administrative tasks or 'superuser' actions, and check for SQL injection patterns in web traffic.
Detection Guidance
"Security teams should monitor VeloCloud Orchestrator audit logs for instances where standard user accounts suddenly execute commands reserved for 'superuser' roles. Because this vulnerability is linked to CWE-89 (SQL Injection), inspect web server logs for unusual SQL syntax in request parameters. Additionally, organizations should follow CISA’s Forensics Triage Requirements to identify existing indicators of compromise (IOCs) on the VCO host that may signal active exploitation."