CVE-2026-114625

CVE-2026-114625 is an SQL injection (CWE-89) in VeloCloud Orchestrator (VCO) on-prem. VCO is the management portal for VeloCloud SD-WAN. Arista's advisory lists it as formerly VeloCloud Orchestrator by Broadcom.

Arista disclosed the flaw on 22 October 2026 in Security Advisory 0199. It says the bug was detected by Arista and is known to be actively exploited.

Any authenticated user can abuse it. That includes Enterprise Read Only, the lowest built-in tenant role. The attacker can then act as a local "superuser operator". That opens functions meant for internal use only. Arista says this can impact the VCO host and the data the orchestrator manages.

An attack needs network access to the VCO web interface and a valid session. VCO is exposed by default. Arista says no configuration prevents the exposure.

Arista rates it CVSS 3.1 9.9. It also gives a CVSS 4.0 score of 9.4. The CVSS 3.1 vector is in the CVSS field. NVD has received the record but has not finished its own analysis.

Affected: VCO on-prem 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12. Arista has not assessed end-of-support releases.

Fixed: 5.2.3.18, 6.1.3.10 and 6.4.2.12, or later in each train. Hosted and Dedicated VCO were also hit. Arista says they are already patched.

VeloCloud Edge and Gateway are not affected. Neither are Arista EOS switches or CloudVision.

CISA KEV: added on 23 October 2026, one day after disclosure. The due date for US federal agencies is 26 October 2026. CISA also flags it for forensic triage. Known ransomware use is unknown.

Indicators. Arista lists two source IPs seen in the attacks. They are defanged here:

• 74.82.197[.]86
• 38.54.50[.]151

Arista also advises a look for unusual or high-rate requests in VCO web logs. Preserve logs before you remediate if you suspect a compromise.

ThreatWire found no public PoC. We do not publish exploit details.

Read the full threat report. Browse actively exploited CVEs.