CVSS 9.9 with a login: the upgrade path VeloCloud operators face for CVE-2026-114625
Security teams often rank post-authentication bugs below pre-auth ones. CVE-2026-114625 needs a valid orchestrator login and still carries 9.9 on the CVSS scale.
The reason is what the login can become. A valid customer account on VeloCloud Orchestrator, even the Enterprise Read Only role, can use a SQL injection to act as a local superuser. That role has full access to the orchestrator.
What the flaw gives an attacker
VCO is the management plane for VeloCloud SD-WAN. Operators create customer and partner accounts, and partners administer groups of customers. A SQL injection in the backend lets crafted input change the query the application runs, and Arista describes the result as superuser context.
With that, an attacker can change the configuration operators control. Arista adds that the flaw may also let an attacker affect the VCO host itself, exposing, modifying or disrupting the orchestrator and the data it manages. The advisory does not describe what the observed attackers did after exploitation, and it does not say when the attacks started.
Why the prerequisite barely slows anyone
Anyone who can reach the web interface and hold a low-privilege login is in scope. VCO is exposed by default and Arista states that no VCO setting prevents that exposure. Low-privilege accounts exist in every deployment: auditors, read-only integrations, contractor logins, and partner staff who need visibility across customers.
Compare the two earlier VCO flaws. CVE-2026-16812 in July and CVE-2026-93952 in September were exploited without authentication. In three months, Arista has published three VCO flaws that were being used in the wild. This one is the first of the three that asks for a login, and it still scores 9.9.
The upgrade path
| Train | Fixed release |
|---|---|
| 5.2 | 5.2.3.18 |
| 6.1 | 6.1.3.10 |
| 6.4 | 6.4.2.12 |
On-premises deployments need the build that matches their train. Hosted and Dedicated orchestrators were patched by Arista. VeloCloud Gateway and VeloCloud Edge are not affected. Releases on the 7.0 train are not on the affected list, and Arista says unlisted releases are not vulnerable.
End-of-support trains were not evaluated. Those customers are directed to Arista TAC for upgrade options, which usually means a longer project than a routine patch window.
There is a specific trap for teams that patched in the summer. The builds that closed the July and September flaws are below the new fixed releases on each train, so those orchestrators remain exposed to CVE-2026-114625. 5.2.3.16 and 6.4.2.8, the September fixes on their trains, are older than 5.2.3.18 and 6.4.2.12.
The open question after patching
The advisory does not say whether upgrading removes access that an attacker already gained. It also does not say whether a compromised orchestrator still provides a route to edge devices, as the July and September advisories warned.
That gap matters for incident response. A team that patches and closes the ticket has answered the vulnerability question and left the compromise question open. Preserving logs before remediation, as Arista recommends, is what keeps the second question answerable.
Interim steps
Until the fixed build runs, Arista recommends restricting VCO web interface access to trusted administrative networks, monitoring for connections from the two addresses named in the advisory (74.82.197[.]86 and 38.54.50[.]151), watching for unexpected outbound traffic from the VCO host, blocking outbound ports normal operations do not need, looking for backdoor daemons and webshells, and reviewing recent administrator activity.
The logs to check for exploitation attempts are the VCO web access logs, where Arista points to unusual URL-like path components, encoded characters, references to local or internal services, and high request rates.
Exposure
ZoomEye returns 529 assets for title="VeloCloud". This counts visible VeloCloud web surface, not confirmed vulnerable orchestrators. Application-fingerprint variants of the query returned zero during this check, so the title match is the widest verified view available.
Sources
- Arista Security Advisory 0199: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
- Arista Security Advisory 0183: https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
- The Hacker News report: https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html
Top comments (0)