CVE-2026-114625: patch actively exploited VeloCloud Orchestrator now

Summary

CVE: CVE-2026-114625
Product: Arista VeloCloud Orchestrator (VCO) On-Prem
Affected releases: 5.2.x before 5.2.3.18; 6.1.x before 6.1.3.10; 6.4.x before 6.4.2.12
Fixed releases: 5.2.3.18, 6.1.3.10 and 6.4.2.12 (or later within the same train)
CVSS: 9.9 CVSS v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; 9.4 CVSS v4.0
EPSS: 0.555% (2026-10-23; percentile 45.586%)
Exploitation: Confirmed. Arista says the issue is actively exploited; CISA added it to KEV on 2026-10-23.
CISA KEV: Yes — action due 2026-10-26 for US federal civilian agencies.
Author urgency assessment: Critical for every exposed On-Prem VCO. A lowest-tier authenticated tenant user can obtain operator-level privileges. Internet exposure and active exploitation make patching and log preservation urgent.

Published CVE record: 22 October 2026. This is not being presented as a newly published CVE today; it is selected from a wider documented window because it entered CISA KEV on 23 October.

What this is

CVE-2026-114625 is an SQL-injection issue in Arista VeloCloud Orchestrator On-Prem. Arista confirms that an authenticated user with only the built-in Enterprise Read Only role can gain operator privileges and masquerade as a local “superuser operator”. That can expose internal-only functionality and can compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.

The issue is not a blanket finding for VeloCloud Edge, VeloCloud Gateway, Arista EOS products or hosted VCO. Arista says hosted and Dedicated VCO instances were affected but have already been patched. This article concerns the On-Prem appliance/software and the versions listed below.

Are you affected?

You are in scope when all of the following are true:

1. You run VCO On-Prem.
2. Its release is 5.2.x earlier than 5.2.3.18, 6.1.x earlier than 6.1.3.10, or 6.4.x earlier than 6.4.2.12.
3. The VCO web interface is reachable from an untrusted or broad network, or a low-privilege tenant account exists.

Arista states that VCO is exposed by default and that exploitation requires network access to the VCO web interface plus a valid authenticated portal session. There is no product configuration that removes the underlying exposure. End-of-support releases have not been assessed: treat them as requiring a TAC-led upgrade decision rather than assuming they are safe.

Safe exposure check

Do not try the vulnerability. From the authenticated VCO administration interface, record the running VCO release and compare it to the fixed release for its train. Also review the network path to the VCO web interface: identify permitted source networks, identity-provider access and any public NAT or reverse proxy.

Expected interpretation:

• A listed pre-fixed release is affected until patched.
• A matching or later fixed release in the same train is not affected by this advisory, subject to confirming the deployed version after upgrade.
• A hosted/Dedicated tenant is not currently known to require customer patching; confirm service status with Arista if you need written assurance.
• An end-of-support release is not proven safe.

NetTools.tech check — DNS Lookup: enter the VCO's approved public hostname to identify its published A/AAAA records and compare them with your documented perimeter. Result: an unexpected public address warrants a firewall/NAT review. Limit: DNS proves only published resolution; it does not prove that the VCO login is reachable, vulnerable or privately routed. Do not scan systems you do not own or administer.

Patch now

Prerequisites

• A current backup and a tested recovery procedure for the VCO appliance.
• A maintenance window and change record.
• Access to the Arista support download path and an authorised VCO administrator.
• A copy of current version, health and configuration evidence.
• If indicators suggest compromise, preserve logs before making changes.

Supported remediation

1. In the VCO operator portal, record the current version and take the vendor-supported backup.
2. Download the fixed image/package for your existing supported train from Arista’s authorised support channel.
3. Upgrade to 5.2.3.18 or later, 6.1.3.10 or later, or 6.4.2.12 or later, respectively. Do not cross trains unless Arista’s upgrade documentation and your change plan call for it.
4. Wait for the documented service restart and confirm that the operator portal, tenant portal and managed Edge connectivity return to their normal state.
5. Record the displayed running version and retain the upgrade audit evidence.

Expected result: the running version is at or above the fixed release for its train, and normal orchestration functions remain available.

Validate

• Re-open the VCO version page and save a timestamped screenshot or change-record entry.
• Confirm that administrator and a representative least-privilege tenant account have the expected, unchanged roles.
• Review the VCO health dashboard and an approved sample of Edge connectivity/telemetry.
• Check VCO web access, application, system and database logs for errors around the maintenance interval.

Rollback

Use only Arista’s documented appliance rollback/recovery process and the pre-change backup. Do not downgrade simply to avoid a service issue without recording the security exception: a rollback to an affected release reintroduces this active-exploitation risk. Escalate a failed upgrade to Arista TAC with the version, timestamps and preserved logs.

Temporary containment while you prepare the patch

Patching is the resolution. These controls reduce reachable attack surface but do not fix the flaw:

1. Restrict VCO web-interface access to trusted administrative networks and approved VPN paths. Remove broad internet access and stale support rules.
2. Restrict who can obtain or retain VCO portal accounts, especially Enterprise Read Only accounts, while preserving essential operations.
3. Monitor and, where appropriate, block the two source IP addresses listed by Arista: 74.82.197.86 and 38.54.50.151. Treat them as indicators, not a complete blocklist.
4. Monitor unexpected outbound connections from the VCO host and block outbound ports that are not required by your documented operations.
5. Review administrator activity for unexplained changes.

Before changing firewall rules, export the existing rule set and obtain the service owner’s approval. Validate from an approved admin network and from a representative tenant path. Roll back by restoring the approved prior rule only if it does not unnecessarily restore public exposure.

Look for evidence before and after remediation

Arista advises reviewing VCO web access logs for unusual URL-like path components, encoded characters, references to local/internal services and high request rates. Those signals are indicators to investigate, not proof of compromise.

If suspicious activity is found, preserve VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediation where operationally feasible. Then isolate the management interface, rotate potentially exposed administrative credentials, and engage Arista TAC or your incident-response process. Do not delete logs or web content as a first response.

What is confirmed and what is not

Confirmed: affected On-Prem version ranges; low-privilege authenticated impact; default VCO exposure; active exploitation according to Arista; CISA KEV inclusion; fixed versions listed above.

Not confirmed by the cited advisories: that every observed request pattern is exploitation, that the two IP addresses are the only attacker infrastructure, that an unlisted end-of-support release is safe, or that VeloCloud Edge/Gateway and Arista EOS products are affected.

Timeline

• 2026-10-22: Arista published Security Advisory 0199 and the CVE record was published.
• 2026-10-23: CISA added CVE-2026-114625 to KEV; FIRST EPSS snapshot used here is dated 2026-10-23.
• 2026-10-24: This article published after source and fixed-version review.

Changes log

• 2026-10-24 (r1): Initial publication. Captures vendor advisory 0199, CISA KEV status and fixed VCO releases.

References

1. Arista Security Advisory 0199 — vendor advisory, affected/fixed versions and containment guidance.
2. NVD CVE-2026-114625 record — publication metadata, CVSS and affected-version record.
3. CISA Known Exploited Vulnerabilities catalog entry — KEV inclusion and due date.
4. FIRST EPSS API record — EPSS value and date.