VeloCloud Orchestrator privilege escalation via SQL injection
A SQL injection flaw in Arista's on-prem VeloCloud Orchestrator lets any authenticated user gain superuser operator privileges, with active exploitation confirmed as of October 22, 2026.
- Vendor
- Arista Networks
- Product
- VeloCloud Orchestrator (VCO) on-premises
- CVSS
- 9.9
- EPSS (exploit probability)
- N/A
- Status
- exploited-in-wild
- Published
Is CVE-2026-114625 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-114625 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-23 snapshot.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-23. Full cross-catalog view: /kev-comparison
CVE-2026-114625 timeline
- Exploitation reportedsame day as NVDActive exploitation observed from two malicious IPs
- Published to NVD
- Vendor advisorysame day as NVDPatches released: 5.2.3.18+, 6.1.3.10+, 6.4.2.12+
- First 0dayNews coverage+1d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Any authenticated VeloCloud Orchestrator user can exploit this SQL injection flaw to escalate to operator-level privileges and masquerade as the internal superuser account. That includes access to functionality intended for internal use only and not meant to be remotely reachable.
Hosted and Dedicated VCO instances were already patched. On-premises operators need to upgrade: fixed versions are 5.2.3.18, 6.1.3.10, and 6.4.2.12.
Active exploitation is confirmed. Two attacker-controlled IPs have been observed in ongoing attacks. Until patched, restrict VCO web interface access to administrative networks and review access logs for anomalous privilege activity.
This is the third VeloCloud Orchestrator flaw to reach active exploitation since July 2026. CVE-2026-16812 and CVE-2026-93952 preceded it.
