Arista VeloCloud Orchestrator CVE-2026-114625: critical SQL injection

What it is and who is affectedCVE-2026-114625 is a SQL injection vulnerability (CWE-89) in Arista VeloCloud Orchestrator, the management platform used...

What it is and who is affected

CVE-2026-114625 is a SQL injection vulnerability (CWE-89) in Arista VeloCloud Orchestrator, the management platform used to run and control VeloCloud SD-WAN deployments. The flaw affects the on-premises edition of VCO. According to the National Vulnerability Database (NVD) of NIST, the vulnerable ranges are:

From 5.2.0 (included) up to, but not including, 5.2.3.18
From 6.1.0 (included) up to, but not including, 6.1.3.10
From 6.4.0 (included) up to, but not including, 6.4.2.12

The severity is critical: CVSS 4.0 score of 9.4. The NVD explains that any authenticated user on an affected system can escalate to operator privileges and impersonate a local "superuser operator" account, reaching internal-only functionality that was never meant to be exposed remotely. Successful exploitation can compromise the confidentiality, integrity and availability of the orchestrator itself and of the data it manages. Hosted versions, including Dedicated, were also impacted but have already been patched by the vendor.

For a Catalan SME running its own SD-WAN controller, this is not an abstract edge case. A VCO instance typically holds network topology, credentials and configuration for every branch it orchestrates, so a foothold there is a foothold across the whole estate.

Why it is urgent: already exploited, with a three-day deadline

This is not a theoretical flaw waiting for a proof of concept. CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities (KEV) catalogue on 23 October 2026, which means it has been observed in real attacks. The vulnerability itself was published in the NVD on 22 October 2026, so the window between disclosure and active exploitation was measured in hours.

CISA gave US federal agencies until 26 October 2026 to apply mitigations following the vendor's instructions, in line with its BOD 26-04 guidance on prioritising security updates by risk. Three days is a deliberately aggressive deadline, and it is a useful benchmark for everyone else: if a public body is expected to close this in 72 hours, a private company should not be sitting on it for weeks. CISA also asks asset owners to evaluate each system's internet exposure and, where no mitigation is available, to discontinue use of the product. There is no record of this CVE being used in ransomware campaigns so far, but that status can change quickly.

What to do today

The first step is inventory, not panic. Confirm whether your organisation runs VeloCloud Orchestrator on-premises at all, and if so, which exact build. Version numbers in this case matter to the third decimal: 5.2.3.17 is vulnerable, 5.2.3.18 is not.

Check the version against the three affected ranges above. If you use the hosted or Dedicated service, the vendor has already patched it, but it is still worth confirming with your provider.
Apply the update or mitigation exactly as described in Arista security advisory 0199. Do not improvise a fix; follow the vendor's instructions for your branch.
Look for signs of intrusion. Because the flaw allows privilege escalation to a superuser operator, review orchestrator logs for unexpected operator-level activity, new or modified accounts, and access to internal-only functions. Treat any authenticated account as a potential entry point.
Reduce what is exposed to the internet. Restrict management access to the VCO interface, place it behind a VPN or a controlled access layer, and apply least privilege to every operator account. This does not replace patching, but it shrinks the attack surface while you roll it out.

Document the whole process. Under GDPR, if the orchestrator manages data relating to identifiable persons and you suspect compromise, you may have notification obligations, and a clear timeline of detection and remediation is what regulators and clients will ask for.

How a cybersecurity team like ALMC's can help

Situations like this one are rarely about a single missing patch. They expose how well a company actually knows its own infrastructure. At ALMC we work with SMEs, online shops and small IT teams across Lleida, Barcelona, Tarragona and Girona on exactly that gap: security audits and pentesting to find weaknesses before someone else does, server hardening, monitoring and incident response when something looks wrong, and maintenance of WordPress, PrestaShop and Joomla installations, plus repair of sites that have already been hacked. When a critical CVE lands with a 72-hour clock, having an inventory, a patching routine and someone to call makes the difference between a controlled update and a very long weekend.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.