What happened
Arista's October 22 advisory describes CVE-2026-114625, a critical SQL injection vulnerability in on-premises VeloCloud Orchestrator (VCO). Arista assigns a CVSS 3.1 score of 9.9 and confirms active exploitation. An attacker who can access the management interface with a valid authenticated session may elevate privileges to a superuser operator, including from the lowest built-in tenant role. The Hacker News reported on October 24 that the U.S. Cybersecurity and Infrastructure Security Agency added this flaw and a separate Collabora Online issue to its Known Exploited Vulnerabilities catalog on October 23. Arista says hosted and dedicated VCO deployments were affected but have already been patched.
Why it matters
An orchestrator manages networking functions, making unauthorized administrative access more consequential than an ordinary single-device flaw. The affected on-premises versions are VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12. Arista says no configuration completely eliminates the underlying exposure on vulnerable releases, although restricting management access can reduce attack opportunities. Vendor-confirmed exploitation makes this a current operational problem rather than merely a theoretical weakness. The available reporting does not establish how many organizations were compromised or the extent of any downstream damage.
What to watch next
Operators should check their exact deployment type and software version against Arista's advisory, then follow supported upgrade guidance. Fixed releases include 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later in their respective trains. The vendor also recommends reviewing web-access logs and unexpected management activity, and preserving evidence if compromise is suspected. Watch for additional CISA guidance and verified incident disclosures. The vulnerability requires an authenticated session and network access, but the confirmed exploitation warrants prompt attention from affected administrators.