What is vulnerability CVE-2026-114625 in Arista VeloCloud Orchestrator?
On-premise VeloCloud Orchestrator (VCO) has a security issue where this problem can allow a remote attacker to access privileged internal functionalities and impact the VCO host. Successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and the data managed by it.
On an affected system, any authenticated user can obtain operator privileges and impersonate a local 'superuser operator' user. This includes access to features intended solely for internal use and not designed to be accessible remotely. Hosted versions of VCO, including Dedicated ones, were impacted and have already been patched centrally.
This flaw has been formally registered under the identifier CVE-2026-114625 and has a CVSS score of 9.9, cataloging it as a critical risk that requires immediate attention from security teams.
Who is affected by this critical vulnerability and why has it gone viral?
The alert directly affects all on-premise deployments of Arista VeloCloud Orchestrator in versions prior to 5.2.3.18. Organizations deploying this network infrastructure locally expose themselves to total compromise if they do not update their systems immediately.
The U.S. Cybersecurity and Infrastructure Security Agency has added this flaw to its catalog of known exploited vulnerabilities, demanding federal agencies and private entities to strengthen their controls. Just like other serious flaws such as the critical flaw in the Rust zip library or the code execution problem in OpenHands, active exploitation requires a rapid and coordinated response.
How do I protect myself against this active exploitation?
To ensure infrastructure security and comply with deadlines established by regulatory bodies, it is essential to apply the official patches and mitigations published by the manufacturer.
Follow the security recommendations by consulting the official advisory and applying the relevant updates in your deployed environments.
- Review internet-exposed assets running on-premise Arista VeloCloud Orchestrator.
- Consult the official Arista Networks security advisory for update details at https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199.
- Update the orchestrator software to version 5.2.3.18 or higher to eliminate the SQL injection vector.
- Follow the forensic triage guidelines and mitigation compliance described in CISA's KEV catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog.