Arista VeloCloud flaw lets any logged-in user become a superuser

Arista VeloCloud flaw lets any logged-in user become a superuser

22 October 2026: Arista has fixed CVE-2026-114625, a critical flaw in on-premises VeloCloud Orchestrator that lets any authenticated user gain operator privileges and pose as the local "superuser operator", reaching functions meant only for internal use and putting the orchestrator host and the data it manages at risk. It is rated 9.4 under CVSS 4.0 and classed as SQL injection. Hosted orchestrators, including Dedicated ones, have already been patched by Arista.

Not yet independently verified. Arista's own advisory page refused our requests, so the details come from its CVE record and CISA's catalogue; neither Arista nor CISA has said how the flaw is being exploited or how widely. We will update this when it can be confirmed, and remove this note.

Fixed versions

Release train	Affected	Fixed in
5.2	5.2.0 to before 5.2.3.18	5.2.3.18
6.1	6.1.0 to before 6.1.3.10	6.1.3.10
6.4	6.4.0 to before 6.4.2.12	6.4.2.12

Arista published the advisory, numbered 0199, on 22 October and recommends upgrading to a fixed release. Its CVSS 4.0 vector describes an attack over the network with low complexity, needing only low privileges and no user interaction, with high impact on the confidentiality, integrity and availability of the orchestrator and of the systems it manages.

Why the orchestrator matters

VeloCloud Orchestrator is the management plane for VeloCloud SD-WAN. It holds the configuration and policy for every edge appliance in a customer's branch network, so control of it is control of how traffic moves between sites, and of the credentials and settings stored with it. The weakness only needs a valid login, but in many deployments that includes read-only accounts, partner and managed-service accounts, and customer-tenant users of service providers who run a shared orchestrator.

CISA now lists it as exploited

An outlet reported on 22 October that attackers are exploiting the flaw as a zero-day, attributing that to Arista's advisory. The CVE record first carried a CISA assessment listing exploitation as none, but on 23 October CISA added CVE-2026-114625 to its catalogue of known exploited vulnerabilities, with a remediation deadline of 26 October for US federal agencies and a requirement for forensic triage. On-premises operators should treat it as urgent: upgrade, review which accounts can log in to the orchestrator and remove the ones that do not need to, and check orchestrator logs for operator-level actions taken by accounts that should not have them.

Sources

• CVE-2026-114625 record (Arista, Security Advisory 0199), 22 October 2026
• Arista Security Advisory 0199, 22 October 2026
• NVD: CVE-2026-114625, 22 October 2026
• CISA: Known Exploited Vulnerabilities catalogue, CVE-2026-114625 added, 23 October 2026