Arista VeloCloud Orchestrator CVE-2026-114625: exploited SQL injection, in CISA KEV

What happened

Arista disclosed an actively exploited flaw in VeloCloud Orchestrator (VCO) on-prem. The bug is CVE-2026-114625. It is an SQL injection.

This is not brand-new. Here is the timeline:

• October 22, 2026: Arista published Security Advisory 0199 with fixed releases. The CVE record went live the same day.
• October 23: CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. Canada's Cyber Centre issued advisory AV26-1080.

Arista found the attacks itself. Its advisory says the issue "was detected by Arista and is known to be actively exploited."

Arista rates it CVSS 3.1 9.9 (Critical). Its CVSS 4.0 score is 9.4.

Who is affected

VCO is the central portal that manages VeloCloud SD-WAN edges and gateways. Arista lists it as formerly VeloCloud Orchestrator by Broadcom.

Affected on-prem releases:

• 5.2.x before 5.2.3.18
• 6.1.x before 6.1.3.10
• 6.4.x before 6.4.2.12

Arista has not assessed end-of-support releases. Treat them as at risk.

Hosted VCO, including Dedicated, was also affected. Arista says it has already patched those. Self-hosted orchestrators are on the operator.

VeloCloud Edge and VeloCloud Gateway are not affected. Arista EOS switches and CloudVision are not affected either.

What is confirmed

Per Arista, any authenticated user can exploit the flaw. The minimum role is Enterprise Read Only, the lowest built-in tenant role.

That user can gain operator rights and pose as a local "superuser operator". This exposes functions meant for internal use only. Arista says the attack can impact the VCO host. It can hurt the confidentiality, integrity and availability of the orchestrator and its data.

The attacker needs two things:

• Network access to the VCO web interface.
• A valid logged-in session on the portal.

VCO is exposed by default. Arista says no configuration setting blocks the issue.

CISA KEV details:

• Date added: October 23, 2026.
• Due date for US federal agencies: October 26, 2026. That is a three-day window.
• Forensic triage: required under CISA's BOD 26-04 guidance.
• Known ransomware use: unknown.

Indicators. Arista lists two IP addresses seen in the attacks. They are defanged:

• 74.82.197[.]86
• 38.54.50[.]151

Arista advises blocking them and searching logs for them.

ThreatWire tracks this as a 0-day. Arista found it being exploited in the wild. No public fix existed before its advisory.

What is not confirmed

• Victims. Arista has not said how many orchestrators were hit, or who.
• Attacker. No group has been named.
• Initial access. The attack needs a valid account. Arista has not said how the attackers got one.
• Post-exploitation. Arista tells defenders to look for webshells and backdoor daemons. It has not said that it found them.
• Public PoC. We found none. ThreatWire does not publish exploit details.
• NVD score. NVD has received the record. It has not finished its own analysis.

What to do

1. Update VCO on-prem to 5.2.3.18, 6.1.3.10 or 6.4.2.12, or later in your train. Unsupported trains should contact Arista TAC.
2. Lock down the web interface. Only trusted admin networks should reach it.
3. Block and search for the two IPs above in firewall and VCO web logs.
4. Review the logs. Arista flags odd URL-like path parts, encoded characters, references to local or internal services, and high request rates.
5. Hunt on the host. Check for unexpected outbound traffic, backdoor daemons and webshells. Block outbound ports you do not need.
6. Audit accounts. Review recent admin activity. Remove read-only and tenant accounts nobody uses. Rotate credentials if you see signs of abuse.
7. Preserve evidence first. Arista asks you to keep web, application, system and database logs, plus file timestamps, before remediation where feasible.
8. US federal agencies: remediate by October 26, 2026, and follow CISA's forensic triage requirements.

Related coverage

Full record: CVE-2026-114625 on ThreatWire.

Other recent KEV additions: Siemens Software Center CVE-2026-110936 and SiteGuard Server Edition CVE-2026-106931. Browse actively exploited CVEs and the CVE tracker.

Sources: Arista Security Advisory 0199, the CISA KEV catalog, CVE.org, NVD, the GitHub Advisory Database and the Canadian Centre for Cyber Security. Links are in the references list.