1-minute read
What a defender needs to know
CISA added CVE-2026-114625, an on-premises Arista VeloCloud Orchestrator SQL-injection flaw, to its exploited-vulnerabilities catalog on October 23. Federal agencies have an October 26 action date. Arista’s CVE record says a user with an authenticated VCO portal session and the lowest built-in tenant role, Enterprise Read Only, can gain local “superuser operator” privileges and reach internal functionality. Hosted and Dedicated VCO instances were affected and have already been patched, according to Arista.
Check the actual on-prem VCO build: affected releases run from 5.2.0 to before 5.2.3.18, 6.1.0 to before 6.1.3.10, and 6.4.0 to before 6.4.2.12. Upgrade to a fixed build in the active train. Restrict the web interface to trusted administrative networks while upgrading; Arista says a configuration change cannot prevent the underlying exposure.
Review portal access, recent administrator changes, unusual VCO host egress, backdoor daemons and webshells on exposed systems. An authenticated tenant session may appear routine until its operator actions are correlated with the account. After the upgrade, verify the running build and test that an untrusted host cannot load the portal while an approved admin host still can. Investigate suspicious host or operator activity separately from that access test.