VeloCloud CVE-2026-114625: What to Do Now
By Chuck Lerch, Founder and CEO, Cyberuptive ·
Upgrade affected on-premises VeloCloud Orchestrator deployments to the fixed release for their train and review suspicious management activity. Arista says CVE-2026-114625 is actively exploited and can elevate an authenticated Enterprise Read Only user to operator privileges (Arista advisory 0199). Hosted and Dedicated deployments were patched by the vendor; verify your deployment type and remaining investigation responsibilities.
Arista’s October 22, 2026 advisory identifies an actively exploited SQL injection issue in VeloCloud Orchestrator (VCO), tracked as CVE-2026-114625 (Arista advisory 0199). SQL means Structured Query Language, and CVE means Common Vulnerabilities and Exposures. Independent reporting confirms the fixed release trains and the distinction between hosted and on-premises remediation (The Hacker News).
What are the key takeaways?
- An attacker needs network access and a valid authenticated session; the lowest built-in tenant role is sufficient (Arista advisory 0199).
- Fixed releases are 5.2.3.18, 6.1.3.10, and 6.4.2.12 on their respective trains (Arista advisory 0199).
- Hosted and Dedicated orchestrators were affected but are already patched (Arista advisory 0199).
- Arista recommends preserving evidence when compromise is suspected, where operationally feasible (Arista advisory 0199).
Who is affected by the advisory?
The customer patching action applies to affected on-premises VeloCloud Orchestrator releases. Arista says hosted deployments, including Dedicated versions, were also impacted but have already been patched (Arista advisory 0199). Identify the actual hosting arrangement before assigning the update task.
The advisory’s applicability list distinguishes the orchestrator from other products; VeloCloud Gateway and Edge are not affected by this specific vulnerability (The Hacker News). Do not use that distinction to infer that an orchestrator compromise is operationally harmless. Investigate the management system and its actual access.
| VCO train | Affected releases | Fixed baseline |
|---|---|---|
| 5.2 | Before 5.2.3.18 | 5.2.3.18 or later in the train |
| 6.1 | Before 6.1.3.10 | 6.1.3.10 or later in the train |
| 6.4 | Before 6.4.2.12 | 6.4.2.12 or later in the train |
These baselines come from Arista; end-of-support versions have not been assessed, and customers on unsupported trains should contact the vendor about upgrade options (Arista advisory 0199).
Why does a read-only account matter?
Arista says the minimum prerequisite is Enterprise Read Only, the lowest built-in tenant role, plus network access and a valid session (Arista advisory 0199). Successful exploitation can grant operator privileges and access to internal functionality, potentially affecting the orchestrator host and managed data (Arista advisory 0199).
A role labeled read-only therefore does not eliminate exposure to this flaw. Our recommendation is to review who can authenticate, which administrative networks can reach the interface, and whether stale or unnecessary accounts remain. Those checks complement patching; they do not replace the fixed software.
What should operators do immediately?
Install the correct fixed release and follow Arista’s defensive guidance while the update is being completed. The vendor says no configuration prevents the vulnerability’s exposure and recommends upgrading as the resolution (Arista advisory 0199).
- Verify deployment and release. Record the orchestrator’s hosting model, installed version, target fixed build, and accountable update owner.
- Restrict management reachability. Arista recommends limiting the web interface to trusted administrative networks while deploying the fix (Arista advisory 0199).
- Review activity. Check unexpected administrator changes, outbound traffic, backdoor processes, and webshells as described in the advisory (Arista advisory 0199).
- Preserve relevant evidence. Where compromise is suspected, retain web access, application, system, and database logs and relevant file timestamps before remediation where feasible (Arista advisory 0199).
- Validate completion. Our recommendation is to verify the running fixed build and essential management workflows, while leaving any incident investigation open until its evidence is resolved.
What should log review focus on?
Arista recommends investigating unusual web requests, encoded characters, references to local or internal services, high request rates, and unexpected outbound activity (Arista advisory 0199). Its advisory also publishes observed attack-source addresses and directs operators to review logs for them (Arista advisory 0199).
Use the original indicator list rather than a copied list that may become stale. Our recommendation is to correlate suspicious requests with authentication, privilege changes, and host activity. A single address match is a lead; the surrounding evidence determines what happened.
The October 22 reporting notes that the advisory does not establish when attacks began, which orchestrators were affected, or the attackers’ complete post-exploitation actions (The Hacker News). Record those uncertainties rather than narrowing the investigation to an unsupported exposure window.
How would our SOC work with the network team?
Our U.S.-based security operations center (SOC) would maintain distinct work items for update verification, access review, and suspected compromise. The network owner would control maintenance and service validation; responders would preserve and analyze the available evidence.
Use managed firewall support, the management-appliance investigation guide, and the SOC pricing guide to make that handoff explicit. This is our proposed response approach, not a report of a customer incident.
What else should buyers and operators know?
Does exploitation require authentication?
Yes. Arista says a valid session is required, with Enterprise Read Only sufficient as the minimum role (Arista advisory 0199).
Are hosted orchestrators waiting for customer patches?
Arista says Hosted and Dedicated versions have already been patched (Arista advisory 0199). Confirm your deployment model and continue any needed investigation.
Can a setting completely remove the exposure?
Arista says no configuration prevents exposure and recommends upgrading; network restrictions are defense in depth (Arista advisory 0199).
Are unsupported releases known safe?
No. Arista says end-of-support software versions have not been assessed (Arista advisory 0199). Contact the vendor for an upgrade path.
What is the next step for your organization?
Bring your scope, current evidence, and unresolved responsibilities to a focused discussion. Schedule a security review or Call 833-92-CYBER to clarify the next practical actions.