CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability

BleepingComputer quotes Arista as saying that "any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user."[2] According to SecurityOnline, Arista's Advisory 0199 says the flaw "was detected by Arista and is known to be actively exploited."[3]The Hacker News reports that an attacker needs network access to the orchestrator's web interface and a valid login. The minimum role is Enterprise Read Only, the lowest built-in role for customer users.[1] SecurityOnline cites Arista as saying that "there is no configuration that can prevent the exposure."[3]According to The Hacker News, the fix for on-premises orchestrators is in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, while Hosted and Dedicated orchestrators have already been patched.[1] The outlet adds that VeloCloud Gateway and VeloCloud Edge are not affected.[1]The Hacker News also reports that orchestrators running the releases that fixed the VCO flaws exploited in July and September are still affected[1]. It says this is the third flaw in VCO since late July that Arista has reported as exploited[1].The Hacker News says the advisory does not say when the attacks began, which orchestrators were hit, or what the attackers did after exploiting the flaw.[1] According to a DEV Community analysis, Arista names two addresses seen in the attacks: 74.82.197[.]86 and 38.54.50[.]151.[4]WindowsForum reports that CISA's KEV Catalog gained a new entry on October 23, 2026: CVE-2026-114625[5].