July's VeloCloud Orchestrator Fixes Do Not Cover Exploited CVE-2026-114625

A user holding any VeloCloud Orchestrator login, down to the lowest built-in tenant role (Enterprise Read Only), can reach internal-only functions and affect the on-premises host through CVE-2026-114625, and Arista says the flaw is "known to be actively exploited." CISA added it to the Known Exploited Vulnerabilities catalog on Oct. 23 with a due date of Oct. 26, three days later.

The fix is VCO 5.2.3.18, 6.1.3.10 or 6.4.2.12, or any later release on the same train, per Arista Security Advisory 0199, dated Oct. 22. Arista says its Hosted and Dedicated VCO instances were affected but are already patched. On-premises customers must upgrade themselves.

Why July's patch level is not enough

Arista published a separate advisory on July 27, Security Advisory 0145, for two other VCO flaws, CVE-2026-17191 and CVE-2026-17192. An administrator who installed those fixes is still exposed.

	July advisory 0145	October advisory 0199
CVE	CVE-2026-17191 (SQL injection to SSRF)	CVE-2026-114625 (SQL injection)
CVSS 3.1	9.1	9.9
Fixed on 5.2 train	5.2.3.14	5.2.3.18
Fixed on 6.1 train	6.1.3.4	6.1.3.10
Fixed on 6.4 train	6.4.2.4	6.4.2.12
Exploitation	None known to Arista	Actively exploited

An installation on 5.2.3.14 through 5.2.3.17, 6.1.3.4 through 6.1.3.9 or 6.4.2.4 through 6.4.2.11 passes the July check and fails the October one. Neither advisory says whether the two bugs share a root cause, and the October page lists no reporter credit.

What the attacker needs and gets

The October advisory scores the flaw 9.9 on CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:C) and 9.4 on CVSS 4.0. The low-privileges requirement (PR:L) is a weaker barrier than it sounds: Arista says any authenticated user can gain operator privileges and impersonate a local "superuser operator" account, and the minimum role is Enterprise Read Only. Arista adds that VCO is exposed by default and no configuration prevents the exposure.

The advisory leaves one oddity unexplained. The weakness class is CWE-89 (SQL injection), yet the described effect is privilege escalation to a superuser operator, and the page does not connect the two.

What to do on an on-premises VCO

Upgrade first. Until then, Arista says to restrict the VCO web interface to trusted administrative networks, block unneeded outbound ports, and review recent administrator activity. Its advisory asks defenders to block and search logs for two addresses, 74.82.197.86 and 38.54.50.151, and to look in the web access logs for unusual URL-like paths, encoded characters, references to internal services and high request rates. Watch for backdoor daemons and web shells.

If compromise is suspected, Arista says to preserve web access, application, system and database logs and file-system timestamps before remediation. CISA's KEV entry flags forensic triage as required under its BOD 26-04 directive. For another KEV entry with a split deadline, see Plex2Shell.

Arista says end-of-support releases were not assessed, and customers on unsupported trains should contact its support team. CISA lists ransomware use of this flaw as unknown; for a ransomware group's advisory, read the SafePay coverage.