Arista says any authenticated user can gain operator privileges and act as the local superuser operator. Arista tags the flaw as SQL injection (CWE-89). Arista published advisory 0199 on 22 October 2026 and says it detected active exploitation. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 23 October 2026.
What it allows
Arista says an affected on-prem VCO lets a remote attacker reach privileged internal functionality and affect the VCO host. On an affected system, any authenticated user can gain operator privileges and masquerade as the local superuser operator. That includes functions meant for internal use only.
An attacker needs network access to the VCO web interface and a valid authenticated session, and Arista says the lowest built-in tenant role, Enterprise Read Only, is enough. It also says the VCO is exposed by default and that no configuration prevents the exposure. The advisory lists two source IP addresses seen in the attacks and asks operators to block them and review logs.
The VCO is the central management point for the SD-WAN, so control of it matters. Arista says successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.
Arista tags the flaw with CWE-89, the class for SQL injection. The advisory text itself does not describe the bug in more detail. It does not say who is behind the attacks, when they began or how many systems were hit.
On 23 October 2026, the day CISA added this flaw to the KEV catalog, it also added CVE-2026-110447 in the Collabora Built-in CODE Server app for Nextcloud. See our Collabora CODE Server flaw record and Nextcloud Collabora CODE Server news post.
This is the third VeloCloud Orchestrator flaw that Arista has said is exploited since July 2026. The first two are CVE-2026-16812 and CVE-2026-93952. We compare all three and the builds that cover them in 3 Exploited Arista VeloCloud Flaws in 88 Days.
Another vendor's SD-WAN management system was also attacked in 2026. See our page on the Cisco SD-WAN authentication bypass and the Cisco SD-WAN exploitation it led to.
On 22 October 2026, the day of the Arista advisory, HPE fixed eight ArubaOS flaws rated CVSS 10.0 that need no login. None was known to be exploited at release. The affected and fixed versions are on our page on the HPE ArubaOS authentication bypass and code execution flaws (CVE-2026-79844).
What our X and dark web checks showed on 23 October 2026.
X: we found 54 distinct posts between 22 October and 23 October, almost all outlets and security accounts repeating the advisory. One search-engine account posted an internet-scan query that it said finds about 520 exposed VeloCloud interfaces worldwide; we did not verify that count. One vendor account claimed webshells and lateral movement. Arista's advisory does not say that, so we treat it as unverified.
Dark web monitoring through Blackhole: 4 posts mention the CVE id and 16 mention VeloCloud. The VeloCloud posts were on Telegram (13), forums (2) and Discord (1); the 4 CVE posts were all on Telegram, and all were reposts of news articles. These are aggregate counts. We did not run or link any code.
Who is affected
VeloCloud Orchestrator On-Prem, per Arista: 5.2.x releases prior to 5.2.3.18, 6.1.x releases prior to 6.1.3.10, and 6.4.x releases prior to 6.4.2.12. Arista says end of support versions have not been assessed.
Builds from the July fix are not enough. Advisory 0145 of 27 July 2026 named 5.2.3.14, 6.1.3.4 and 6.4.2.4 as fixed for a different bug. Each of those is older than the build this flaw needs.
Arista says hosted VCO, including Dedicated, was affected and has already been patched. Customers on those services do not need to update. Customers who run their own VCO do.
Timeline
- 27 Jul 2026
Arista advisory 0145 fixes a different SQL injection, CVE-2026-17191, in builds 5.2.3.14, 6.1.3.4 and 6.4.2.4.
- 22 Oct 2026
Arista publishes advisory 0199 for CVE-2026-114625 and says the issue was detected by Arista and is known to be actively exploited.
- 22 Oct 2026
The CVE record appears in the National Vulnerability Database, with Arista as the source. By 23 October its status was still Received.
- 23 Oct 2026
CISA adds CVE-2026-114625 to its KEV catalog with a due date of 26 Oct 2026. The entry marks forensic triage as required and known ransomware use as Unknown.
What to do
-
Check your build
Find the VCO version in your own deployment. Anything older than 5.2.3.18, 6.1.3.10 or 6.4.2.12 in its train is affected.
-
Update to a fixed build
Install 5.2.3.18 or later in the 5.2 train, 6.1.3.10 or later in the 6.1 train, or 6.4.2.12 or later in the 6.4 train.
-
Restrict access
Arista advises limiting access to the VCO web interface to trusted administrative networks.
-
Watch the host
Arista advises monitoring for access from known malicious source IPs, for unexpected outbound traffic from the VCO host, and for backdoor daemons and webshells. It also suggests blocking outbound ports that normal operation does not need.
-
Review admin activity
Review recent administrator activity for unexpected changes, since the flaw gives superuser operator rights.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Is CVE-2026-114625 being exploited?
Yes. Arista's advisory says the issue was detected by Arista and is known to be actively exploited. It does not name the attackers.
Is CVE-2026-114625 in the CISA Known Exploited Vulnerabilities catalog?
Yes. CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities catalog on 23 October 2026, with a due date of 26 October 2026. The entry marks forensic triage as required and lists known ransomware campaign use as Unknown. Its required action points to vendor mitigations and to CISA's BOD 26-04 guidance.
Which VeloCloud Orchestrator versions fix it?
5.2.3.18 and later in the 5.2 train, 6.1.3.10 and later in the 6.1 train, and 6.4.2.12 and later in the 6.4 train.
Do I need to patch hosted VCO?
No. Arista says hosted and Dedicated VCO were affected and have already been patched. The update is for on-prem installs.
Does the attacker need a login?
Yes, a valid session on the VCO portal, plus network access to its web interface. Arista says the lowest built-in tenant role, Enterprise Read Only, is enough, and that the web interface is exposed by default with no configuration that prevents it. That is why restricting who can reach the web interface matters.
Is this the same as the July 2026 VCO SQL injection?
No. Advisory 0145 of 27 July 2026 covers CVE-2026-17191 and CVE-2026-17192. This one is CVE-2026-114625 in advisory 0199.
