CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability

According to The Hacker News, the flaw is tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale.[2] SecurityWeek says it is described as a remotely exploitable SQL injection.[1]Arista's advisory says that "any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user."[3] The advisory also says the minimum user role required is Enterprise Read Only, the lowest built-in tenant role[3], and that "there is no configuration that can prevent the exposure."[3]The Hacker News reports that the on-premises fix is in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, while Hosted and Dedicated orchestrators have already been patched.[2] The outlet adds that orchestrators running the releases that fixed the July and September flaws are still affected[2].According to the same report, VeloCloud Gateway and VeloCloud Edge are not affected.[2] The Hacker News also notes that the advisory does not say when the attacks began, which orchestrators were hit, or what the attackers did after exploiting the flaw.[2]The developer site DEV Community reports that Arista names two addresses seen in the attacks: 74.82.197[.]86 and 38.54.50[.]151.[4]Safeguard says that when it checked CISA's KEV JSON feed on 23 October 2026[5], the catalog does not contain CVE-2026-114625.[5]