Summary
- CVE-2026-114625 carries a CVSS 3.1 score of 9.9 and affects specified on-premises VCO branches.
- An authenticated account can reach privileged internal functionality and impersonate a superuser operator.
- Arista reports exploitation; hosted deployments have been patched, while affected on-premises installations need updates.
Arista Networks has warned that a critical vulnerability in VeloCloud Orchestrator is being actively exploited, allowing a user with limited authenticated access to obtain extensive privileges on affected management systems. The company says hosted deployments, including dedicated hosted services, have already been patched, while operators of specified on-premises releases must check their versions and apply fixes.
Security Advisory 0199, dated 22 October, tracks the issue as CVE-2026-114625. Arista gives it a CVSS 3.1 base score of 9.9 and a CVSS 4.0 score of 9.4. The vulnerability is classified as SQL injection and can allow any authenticated user of an affected orchestrator to masquerade as a local superuser operator, reaching management functions not intended for ordinary remote users.
The distinction between authentication and authorisation is central to the risk. The flaw does not mean a visitor without credentials can automatically take over every VeloCloud deployment. It means that possession of an account with lower privileges may provide an avenue to functions that should require substantially greater authority. The potential impact can be broad because the orchestrator centrally manages network configuration and associated operational information.
Arista lists affected 5.2.x releases before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12. Software outside the affected-version list is not vulnerable to this issue on the basis of the advisory. End-of-support releases have not been assessed, leaving organisations using unsupported software to determine their own exposure without an assured vendor fix path.
According to Arista, the problem can compromise the confidentiality, integrity and availability of the orchestrator and the information managed through it. That does not establish that every network device attached to a vulnerable orchestrator has been altered. Successful exploitation and the extent of operational access require investigation within each affected environment.
The company says it detected the issue itself and knows that it has been exploited. Canada’s national cybersecurity authority reiterated the exploitation status in a 23 October advisory. Neither notice publicly identifies the attackers, the number of affected customers or the specific actions carried out in known incidents.
Hosted and on-premises customers face different remediation paths. Arista has patched hosted versions, including dedicated deployments, while on-premises customers retain responsibility for their own upgrade and verification processes. Enterprises therefore need to establish where their orchestrators are operated rather than assuming that the vendor’s hosted remediation protects a self-managed instance.
Management-plane vulnerabilities can be disproportionate to the size of the affected application. An orchestrator may hold device inventories, configuration information, policy definitions or privileged administrative functions spanning multiple sites. Even if ordinary network traffic remains available, unauthorised changes at the management layer can undermine confidence in how those networks are configured and governed.
Incident investigation should also distinguish legitimate administrative activity from actions performed through an elevated session. Reviewing audit records, account access and configuration changes can establish whether the exploit was attempted or used successfully. The public advisory does not supply evidence that any named UK or European network has been compromised.
The need for a vendor update is separate from a review of past access. Installing fixed software closes the documented vulnerability, but a confirmed intrusion can require further examination of administrative accounts, session activity and changes made while the weakness was accessible.
The SQL injection classification should not be mistaken for a generic public website database leak. In this setting the more immediate concern is crossing a privilege boundary inside a network orchestration service. Administrative commands, credentials and control functions may reside behind interfaces intended only for operators. The advisory establishes a route to those functions for an already authenticated user; it does not identify how attackers obtained their initial accounts in observed exploitation.
CISA also added CVE-2026-114625 to its Known Exploited Vulnerabilities catalogue on 23 October, recording a 26 October remediation date for relevant US federal civilian systems. That federal date is not a general legal deadline for operators in the UK or Europe; the advisory still provides no named victims or technical history of the observed intrusions.
