server · disclosed 22 October 2026
Arista VeloCloud Orchestrator SQL injection exploited as a zero-day
A SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-premises VeloCloud Orchestrator lets any logged-in user, even with read-only access, escalate to superuser operator. Arista patched it on 22 October after it was exploited as a zero-day; CISA listed it as exploited on 23 October. Hosted and dedicated orchestrators are already patched.
- Detectable by a website scanNo, server-side only
- Last reviewed24 October 2026
Timeline
- Arista Security Advisory 0199 published with fixed releases.
- CISA adds CVE-2026-114625 to its Known Exploited Vulnerabilities catalog.
Affected packages
| Package | Affected versions |
|---|---|
VeloCloud Orchestrator (on-premises) | 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12 |
What to do
- Upgrade to 5.2.3.18, 6.1.3.10, 6.4.2.12 or later.
- Review orchestrator accounts for unexpected operator or superuser privileges.
- Check logs for the indicator IP addresses listed in Arista advisory 0199.
- Restrict the orchestrator portal to trusted networks.
Sources
- Arista Security Advisory 0199
- CVE-2026-114625 record
- BleepingComputer: Arista patches VeloCloud Orchestrator zero-day exploited in attacks
We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.