Skip to main content
Apexward Pulse

Arista · SQL injection

Arista VeloCloud Orchestrator SQL Injection Vulnerability

CVE-2026-114625

What this means

This is rated critical severity (9.4 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Arista Velocloud Orchestrator is in your estate, and treat that as the priority.

Full vendor description

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Scoring and exploitation

9.4/ 10
CVSS 4.0 base scoreCritical

Exploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity, availability, subsequent confidentiality, subsequent integrity and subsequent availability.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Attack requirementsNoneAT:N
Privileges requiredLowPR:L
User interactionNoneUI:N

Impact

Longer bar: more harm

ConfidentialityHighVC:H
IntegrityHighVI:H
AvailabilityHighVA:H
Subsequent confidentialityHighSC:H
Subsequent integrityHighSI:H
Subsequent availabilityHighSA:H
~1% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Arista VeloCloud Orchestrator

Weaknesses

CWE-89

Affected products ()

  • Arista Velocloud Orchestrator
Show the raw CPE strings (1)
  • cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*

References

2 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events

  • Arista VeloCloud Orchestrator SQL Injection Vulnerability

    Type Vulnerability

    CISA has added one new vulnerability to its known-exploited catalogue, based on evidence of active exploitation.

    Next step: Confirm whether Arista VeloCloud Orchestrator is in your estate.

    Who's reporting

    1 of 3 perspectives

    Official authority: Official 2Vendor statement missing. no VendorResearcher coverage missing. no Researcher2 signals

    Only official coverage so far. Treat as an early signal.

    Arista VeloCloud Orchestrator
    CVE-2026-114625