ARISTA has disclosed CVE-2026-114625, a critical SQL injection flaw in on-prem VeloCloud Orchestrator (VCO) deployments. The vulnerability, which is being actively exploited in the wild, allows any authenticated portal user—even an Enterprise Read Only account—to escalate to local superuser operator privileges. Arista’s advisory notes that exploitation can impact the confidentiality, integrity, and availability of the orchestrator and the data it manages.
Organizations should upgrade immediately to the fixed release for their branch, restrict VCO web interface access to trusted networks, and review logs for indicators identified by Arista.
Affected releases span three VCO branches: 5.2 (up to but not including 5.2.3[.]18), 6.1 (up to but not including 6.1.3[.]10), and 6.4 (up to but not including 6.4.2[.]12), with fixed releases 5.2.3[.]18+, 6.1.3[.]10+, and 6.4.2[.]12+ respectively. VeloCloud Gateway and VeloCloud Edge are not affected, and hosted or dedicated VCO services have already been patched.
Exploitation requires access to the VCO web interface and a valid authenticated session, with no user interaction needed beyond a login; the privilege requirement remains low. Arista has observed active exploitation from specific IPs (74.82.197[.]86 and 38.54.50[.]151), but even systems without those indicators may be compromised.
Defenders should review web access logs, preserve evidence, patch to the recommended fixed releases, limit exposure to trusted networks, and audit authenticated accounts for unusual activity.