Quick answers
- Is CVE-2026-114625 exploited in the wild?
- Yes. CVE-2026-114625 is known to be exploited in the wild, first recorded on 23 October 2026. Treat it as urgent.
- How severe is CVE-2026-114625?
- Critical severity, with a CVSS score of 9.9, published 22 October 2026.
- Which products and versions are affected?
- Arista Velocloud Orchestrator 5.2.x prior to 5.2.3.18, 6.1.x prior to 6.1.3.10, 6.4.x prior to 6.4.2.12.
- Is there a fix for CVE-2026-114625?
- Yes: fixed in VCO 5.2.3.18 and later in the 5.2 train, VCO 6.1.3.10 and later in the 6.1 train, VCO 6.4.2.12 and later in the 6.4 train. Until then: Restrict access to the VCO web interface to trusted administrative networks, monitor for access from known malicious IPs (74.82.197.86, 38.54.50.151), monitor for unexpected outbound network activity and unauthorized administrator changes, and block outbound ports not needed for normal operations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-114625 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-114625?
- Check whether you run Arista Velocloud Orchestrator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: VCO 5.2.3.18 and later in the 5.2 train, VCO 6.1.3.10 and later in the 6.1 train, VCO 6.4.2.12 and later in the 6.4 train
Restrict access to the VCO web interface to trusted administrative networks, monitor for access from known malicious IPs (74.82.197.86, 38.54.50.151), monitor for unexpected outbound network activity and unauthorized administrator changes, and block outbound ports not needed for normal operations.
Technical details
An SQL injection vulnerability (CWE-89) in VCO on-premises allows any authenticated user with minimal privileges (Enterprise Read Only role or higher) to gain operator-level privileges and impersonate a superuser operator through the VCO web interface. The attack requires network access to the VCO web portal and a valid authenticated session; no additional user interaction is needed. This grants access to internal functionality not intended for remote access and can lead to full system compromise.
Affected products
- Arista VeloCloud Orchestrator 5.2.x prior to 5.2.3.18, 6.1.x prior to 6.1.3.10, 6.4.x prior to 6.4.2.12
Timeline
- 2026-10-22: advisory
- 2026-10-22: exploited: Known to be actively exploited in the wild