The issue

A valid login does not make this a low-risk flaw

Arista describes CVE-2026-114625 as a SQL-injection issue in on-prem VeloCloud Orchestrator. An authenticated user can gain operator privileges and impersonate a local superuser operator, reaching functions intended for internal use. The minimum role needed is Enterprise Read Only. Arista says the issue is actively exploited, and CISA added it to its Known Exploited Vulnerabilities catalog on 23 October.

The affected on-prem branches are 5.2 before 5.2.3.18, 6.1 before 6.1.3.10, and 6.4 before 6.4.2.12. Arista says its hosted and dedicated deployments were impacted but have already been patched. End-of-support versions have not been assessed.

Scope the right product

This advisory concerns the orchestrator, not every VeloCloud Edge or Gateway. Confirm where the web interface is reachable and who can obtain a portal session.

Defender note

Treat the management plane as both a patch and investigation task

  1. 1

    Confirm exposure and version. Inventory each on-prem orchestrator, its running release and the networks that can reach its web interface. Include standby and disaster-recovery systems.

  2. 2

    Preserve evidence. Keep web-access, application, system and database logs before disruptive remediation where possible. Investigate unusual URL paths, encoded characters, internal-service references and high request rates, as Arista advises.

  3. 3

    Upgrade and verify. Move to the fixed release for the installed branch. Until then, restrict management access to trusted administrative networks and watch for unexpected outbound activity or administrator changes.

Blocking the two source addresses in Arista's advisory may help triage, but it cannot establish that an orchestrator is clean. Review the broader activity and retain a clear record of which logs and time periods were actually available.