Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-114625

Published 2026-10-22

Updated 16 hours ago

Vendor/s

Arista

Product/s

VeloCloud Orchestrator

Version/s

5.2.0 > 5.2.3.18

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

9.9

/ 10

Critical

Severity Details

Base score

9.9 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-114625 is a critical (CVSS 9.9) privilege escalation flaw in Arista VeloCloud Orchestrator that is currently being exploited in the wild.

## Why this matters

"CVE-2026-114625 is a critical privilege escalation vulnerability in Arista VeloCloud Orchestrator (VCO) with a near-perfect CVSS score of 9.9. This flaw is particularly dangerous because it allows any authenticated user to elevate their permissions to 'superuser operator' status, granting them full control over the orchestrator and all managed network data. Its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog confirms that attackers are actively leveraging this flaw. For organizations using on-prem VCO instances, this represents a severe risk to software-defined networking infrastructure, potentially leading to a total compromise of network confidentiality, integrity, and availability."

## CPE

Arista

| Product                 | Version Start | Version End (excl.) | Status     |
| ----------------------- | ------------- | ------------------- | ---------- |
| velocloud\_orchestrator | 5.2.0         | 5.2.3.18            | vulnerable |
| velocloud\_orchestrator | 6.1.0         | 6.1.3.10            | vulnerable |
| velocloud\_orchestrator | 6.4.0         | 6.4.2.12            | vulnerable |

## Related weakness (CWE)

CWE-89

## Remediation plan

1

### Apply official patches

Consult Arista Security Advisory 0199 and immediately apply the security updates provided for on-prem VeloCloud Orchestrator (VCO) deployments.

2

### Update affected systems

Upgrade all VCO instances to version 5.2.3.18, 6.1.3.10, or 6.4.2.12 or higher, depending on your current software release branch.

3

### Restrict access

Isolate the VCO management interface from the public internet and restrict access to trusted administrative networks using strict firewall rules or VPNs.

4

### Monitor for exploitation

Audit orchestrator logs for low-privileged users performing administrative tasks or 'superuser' actions, and check for SQL injection patterns in web traffic.

## Detection Guidance

"Security teams should monitor VeloCloud Orchestrator audit logs for instances where standard user accounts suddenly execute commands reserved for 'superuser' roles. Because this vulnerability is linked to CWE-89 (SQL Injection), inspect web server logs for unusual SQL syntax in request parameters. Additionally, organizations should follow CISA’s Forensics Triage Requirements to identify existing indicators of compromise (IOCs) on the VCO host that may signal active exploitation."

## References

[https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 Mitigation Vendor Advisory ](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-114625 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)