What is CVE-2026-114625?

CVE-2026-114625 is a critical-severity vulnerability in Arista Velocloud Orchestrator, classified under SQL Injection. CVSS score: 9.9/10. Published 2026-10-22.

How severe is CVE-2026-114625?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Is CVE-2026-114625 known to be exploited?

Yes. CVE-2026-114625 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-10-23), indicating it is being actively exploited.

SQL Injection in Arista Velocloud Orchestrator

CVE-2026-114625

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Vulnerability class: SQL Injection

Published 2026-10-22 · last modified 2026-10-23.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

CWE-89 — SQL Injection

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2026-10-23. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2026-10-26.

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

www.arista.com/en/support/advisories-notices/security-advisory/24838-security-a… (vendor-advisory, Mitigation, Vendor Advisory)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)

Frequently asked questions

What is CVE-2026-114625?: CVE-2026-114625 is a critical-severity vulnerability in Arista Velocloud Orchestrator, classified under SQL Injection. CVSS score: 9.9/10. Published 2026-10-22.
How severe is CVE-2026-114625?: Critical severity. CVSS v3 base score is 9.9 out of 10.
Is CVE-2026-114625 known to be exploited?: Yes. CVE-2026-114625 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-10-23), indicating it is being actively exploited.