Arista VeloCloud flaw lets any logged-in user become a superuser

Arista VeloCloud flaw lets any logged-in user become a superuser

22 October 2026: Arista has fixed CVE-2026-114625, a critical flaw in on-premises VeloCloud Orchestrator that lets any authenticated user gain operator privileges and pose as the local "superuser operator", reaching functions meant only for internal use and putting the orchestrator host and the data it manages at risk. It is rated 9.4 under CVSS 4.0 and classed as SQL injection. Hosted orchestrators, including Dedicated ones, have already been patched by Arista.

Not yet independently verified. Arista's own advisory page refused our requests, so the details come from its CVE record. One outlet reports the flaw is being exploited as a zero-day; CISA's assessment in the record lists no known exploitation, and it is not in CISA's catalogue of exploited flaws. We will update this when it can be confirmed, and remove this note.

Fixed versions

Release train	Affected	Fixed in
5.2	5.2.0 to before 5.2.3.18	5.2.3.18
6.1	6.1.0 to before 6.1.3.10	6.1.3.10
6.4	6.4.0 to before 6.4.2.12	6.4.2.12

Arista published the advisory, numbered 0199, on 22 October and recommends upgrading to a fixed release. Its CVSS 4.0 vector describes an attack over the network with low complexity, needing only low privileges and no user interaction, with high impact on the confidentiality, integrity and availability of the orchestrator and of the systems it manages.

Why the orchestrator matters

VeloCloud Orchestrator is the management plane for VeloCloud SD-WAN. It holds the configuration and policy for every edge appliance in a customer's branch network, so control of it is control of how traffic moves between sites, and of the credentials and settings stored with it. The weakness only needs a valid login, but in many deployments that includes read-only accounts, partner and managed-service accounts, and customer-tenant users of service providers who run a shared orchestrator.

Exploitation is disputed

An outlet reported on 22 October that attackers are exploiting the flaw as a zero-day, attributing that to Arista's advisory. The CVE record carries a CISA assessment, made the same evening, that lists exploitation as none, and the flaw was not in CISA's catalogue of known exploited vulnerabilities at its last update. Until that is settled, on-premises operators should treat it as urgent: upgrade, review which accounts can log in to the orchestrator and remove the ones that do not need to, and check orchestrator logs for operator-level actions taken by accounts that should not have them.

Sources

• CVE-2026-114625 record (Arista, Security Advisory 0199), 22 October 2026
• Arista Security Advisory 0199, 22 October 2026
• NVD: CVE-2026-114625, 22 October 2026