CVE-2026-114625
published 2026-10-22CVE-2026-114625: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact…
PriorityP192critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-10-26
Exploited in the wild
EPSS
1.03%
63.3th percentile
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arista | velocloud_orchestrator | >= 5.2.0 < 5.2.3.18 | 5.2.3.18 |
| arista | velocloud_orchestrator | >= 6.1.0 < 6.1.3.10 | 6.1.3.10 |
| arista | velocloud_orchestrator | >= 6.4.0 < 6.4.2.12 | 6.4.2.12 |
| arista_networks | velocloud_orchestrator | >= 5.2.0 < 5.2.3.18 | 5.2.3.18 |
| arista_networks | velocloud_orchestrator | >= 6.1.0 < 6.1.3.10 | 6.1.3.10 |
| arista_networks | velocloud_orchestrator | >= 6.4.0 < 6.4.2.12 | 6.4.2.12 |
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.9CRITICAL
cisa9.9CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host.
ghsa_unreviewed·2026-10-22
CVE-2026-114625 [CRITICAL] CWE-89 VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
VulDB
Arista VeloCloud Orchestrator prior 5.2.3.18/6.1.3.10/6.4.2.12 privileges management (EUVD-2026-108511)
vuldb·2026-10-22
CVE-2026-114625 Arista VeloCloud Orchestrator prior 5.2.3.18/6.1.3.10/6.4.2.12 privileges management (EUVD-2026-108511)
A vulnerability was found in Arista VeloCloud Orchestrator and classified as very critical. The affected element is an unknown function. Executing a manipulation can lead to improper privilege management.
The identification of this vulnerability is CVE-2026-114625. The attack may be launched remotely. There is no exploit available.
It is suggested to upgrade the affected component.
VulnCheck
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
vulncheck·2026·CVSS 9.9
CVE-2026-114625 [CRITICAL] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Affected: Arista VeloCloud Orchestrator
Requ
CISA
Arista VeloCloud Orchestrator SQL Injection Vulnerability
cisa·2026-10-23·CVSS 9.9
CVE-2026-114625 [CRITICAL] CWE-89 Arista VeloCloud Orchestrator SQL Injection Vulnerability
Vulnerability: Arista VeloCloud Orchestrator SQL Injection Vulnerability
Affected: Arista VeloCloud Orchestrator
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are
No detection rules found.
No public exploits indexed.
Hackernews
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
blogs_hackernews·2026-10-24·CVSS 9.2
CVE-2026-110447 [CRITICAL] CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities ( KEV ), citing reports of active exploitation in the wild.
The critical-severity vulnerabilities are listed below -
CVE-2026-110447 (CVSS score: 9.2) - An operating system command injection vulnerability in Collabora Online – Built-in CODE Server (aka richdocumentscode) when used within the NextCloud platform t
Hackernews
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
blogs_hackernews·2026-10-23·CVSS 9.9
CVE-2026-114625 [CRITICAL] Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.
The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.
For on-premises orchestrators, the fix is in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, while Hosted and Dedicated orchestrators have already been patched.
The flaw is tracked as CVE-2026-114625
2026-10-22
Published
2026-10-23
Added to CISA KEV
Exploited in the wild