Remote Access Vulnerability in VeloCloud Orchestrator by Arista Networks
CVE-2026-114625

9.4CRITICAL

Key Information:

Vendor

Arista Networks

Status
Velocloud Orchestrator
Vendor
CVE Published:
22 October 2026

Badges

📰 News Worthy

What is CVE-2026-114625?

A security issue in VeloCloud Orchestrator (VCO) allows authenticated users to gain operator privileges, enabling them to access internal functions meant for local use only. This may lead to unauthorized access and compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages. The vulnerability affects both hosted and dedicated versions of VCO, which have received patches to rectify the issue.

Affected Version(s)

VeloCloud Orchestrator VeloCloud Orchestrator On-Prem 5.2.0 < 5.2.3.18

VeloCloud Orchestrator VeloCloud Orchestrator On-Prem 6.1.0 < 6.1.3.10

VeloCloud Orchestrator VeloCloud Orchestrator On-Prem 6.4.0 < 6.4.2.12

News Articles

favicon imageThe Hacker News

Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks

Attackers are exploiting CVE-2026-114625 in VeloCloud Orchestrator, allowing logged-in users to gain full operator privileges.

4 hours ago

References

https://www.arista.com/en/support/advisories-notices/secu...
vendor-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 📰

    First article discovered by The Hacker News

  • Vulnerability published

  • Vulnerability Reserved

.