CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Allows Privilege Escalation
An authenticated user can exploit SQL injection in VeloCloud Orchestrator to gain operator-level privileges and access internal functionality. This flaw is actively exploited and affects on-premises deployments across multiple versions.
Arista VeloCloud Orchestrator versions 5.2.0–5.2.3.17, 6.1.0–6.1.3.9, and 6.4.0–6.4.2.11 contain a SQL injection flaw that allows any authenticated user to escalate to operator privileges and bypass intended access controls. Hosted versions have already been patched by the vendor. This vulnerability has been actively exploited in the wild and impacts the confidentiality, integrity, and availability of the orchestrator and all managed data.
| CVE | CVE-2026-114625 |
|---|---|
| Severity | Critical (CVSS 9.9) |
| Actively exploited | Yes, listed in CISA's Known Exploited Vulnerabilities catalog on 23 Oct 2026 |
| CISA remediation deadline | 26 Oct 2026 |
| Weakness | CWE-89 (SQL injection) |
| Attack vector | Network |
| Privileges required | Low |
| User interaction | None |
| Published | 22 Oct 2026 |
How the attack works
An authenticated attacker crafts a malicious SQL query through a vulnerable endpoint that does not properly sanitize user input before constructing SQL statements. By injecting SQL code, the attacker can modify queries to grant themselves elevated operator privileges or extract sensitive data from the database. This allows masquerading as a superuser and accessing internal functionality that should not be remotely accessible.
Who is affected
Organizations running Arista VeloCloud Orchestrator on-premises in versions 5.2.0 through 5.2.3.17, 6.1.0 through 6.1.3.9, or 6.4.0 through 6.4.2.11. Hosted and Dedicated versions have been patched by Arista.
Affected products listed:
- Arista Velocloud Orchestrator (from 5.2.0, before 5.2.3.18)
- Arista Velocloud Orchestrator (from 6.1.0, before 6.1.3.10)
- Arista Velocloud Orchestrator (from 6.4.0, before 6.4.2.12)
How to check if you're exposed
- Inventory all Arista VeloCloud Orchestrator instances and note their version numbers via the admin console or API
- Check for versions in the affected ranges: 5.2.0–5.2.3.17, 6.1.0–6.1.3.9, 6.4.0–6.4.2.11
- Review VCO access logs for unusual database queries or SQL error messages originating from authenticated users
- Monitor for unexpected privilege escalations or creation of new operator accounts in audit logs
How to fix it
- Upgrade to Arista VeloCloud Orchestrator 5.2.3.18, 6.1.3.10, or 6.4.2.12 or later depending on your current version
- Apply all vendor security patches immediately per CISA BOD 26-04 guidance
- Perform forensic triage and review access logs for signs of exploitation before and after patching
If you can't patch yet
- Restrict network access to VeloCloud Orchestrator to trusted administrative networks only using firewall rules or network segmentation
- Disable remote access to the orchestrator if not required for operations; use VPN or bastion hosts to limit exposure
- Monitor and log all database connections and authentication events to detect suspicious activity
Need help checking your exposure or patching at scale? FutureOps InfoTech can help.