CVE-2026-114625criticalunder attackCWE-89

CVE-2026-114625: critical vulnerability in Arista Networks VeloCloud Orchestrator

Security Advisory 0199

Published · Updated

Follow this CVE+ Monitor VeloCloud Orchestrator

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

78Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.4epss 1.0%
from disclosure to weapon6 days
Published on NVDOct 22
1st PoC+6d
CISA KEV+1d
Action required by CISAfederal deadline: 2026-10-26

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

On-premises VeloCloud Orchestrator (VCO) has a flaw that lets any logged-in user gain operator-level privileges and pose as an internal superuser. This can expose features meant only for internal use and put the orchestrator and its data at risk.

Technical detail

A remote attacker with any valid authenticated account on an on-prem VCO can obtain operator privileges and masquerade as the local 'superuser operator', reaching functionality not intended for remote access. Successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator host and the data it manages (CVSS 9.4, CRITICAL). Hosted and Dedicated VCO versions were also affected and have already been patched.

Summary generated and translated by AI from the official description.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Arista Networks · VeloCloud Orchestrator
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.