CVE-2026-114625 targets Arista VeloCloud Orchestrator (VCO) in on-prem deployments. NVD published it on October 22, 2026; CISA added it to the KEV catalog the next day, October 23, with a deadline of October 26.
That makes it the third VCO CVE in KEV since the summer, after CVE-2026-16812 in July and CVE-2026-93952 in September. The detail that matters most: the version bounds went up again. An instance patched for September's flaw can still be exposed to this one.
The vulnerability
| Field | Value |
|---|---|
| CVE | CVE-2026-114625 |
| CVSS 3.1 (Arista) | 9.9 (CRITICAL) — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| CVSS 4.0 (Arista) | 9.4 (CRITICAL) — AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| Type | SQL injection (CWE-89) |
| Privileges required | Any authenticated account |
| NVD published | 2026-10-22 |
| Added to CISA KEV | 2026-10-23 |
| CISA deadline | 2026-10-26 |
Both scores come from Arista as the CNA. NVD has analyzed the entry (CPE configurations are published) but has not added a score of its own.
From the NVD description:
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
From any account to "superuser operator"
The mechanism is SQL injection (CWE-89, which is also how CISA names the entry). The outcome is privilege escalation: any authenticated orchestrator user — a read-only customer login, a partner account, a support account — gets operator rights and can pose as the local "superuser operator".
In VCO, operator is the tier that runs the orchestrator itself, above enterprise accounts. That's what the S:C (scope changed) in the vector reflects: the impact leaves the attacker's own account and reaches, per the description, the VCO host and the data it manages.
PR:L is the only thing keeping it from a 10.0. On an orchestrator, though, low-privilege accounts are plentiful: every customer of a managed service provider has one, and stolen credentials will do.
Same orchestrator, same blast radius
As with the two previous CVEs, owning the orchestrator means owning every SD-WAN edge it manages: the topology of every site, routing policies, and configuration pushed to the whole network in a single operation. For a managed service provider, that's every customer at once.
Who needs to act
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Same as September: orchestrators hosted by Arista (shared or dedicated) are already fixed. The work falls on on-prem instances.
Affected versions
| Branch | Affected versions (NVD) | First version outside the range |
|---|---|---|
| 5.2 | 5.2.0 → before 5.2.3.18 | 5.2.3.18 |
| 6.1 | 6.1.0 → before 6.1.3.10 | 6.1.3.10 |
| 6.4 | 6.4.0 → before 6.4.2.12 | 6.4.2.12 |
⚠️ These are bounds taken from NVD, not necessarily the build to install. Arista Security Advisory 0199 gives the recommended version for each branch.
Compared with September: for CVE-2026-93952, NVD set the bounds at 5.2.3.16, 6.1.3.7 and 6.4.2.8. CVE-2026-114625's bounds are higher on all three branches, so an instance updated exactly to September's bound is still inside today's vulnerable range.
The 7.0 branch: September's flaw listed it; this one doesn't. NVD has no 7.0 configuration for CVE-2026-114625. Don't take that as proof a 7.0 instance is safe until you've checked Arista's advisory.
Detection
- Operator activity: anything done under the local "superuser operator" account, or operator-level actions from a session opened by an enterprise or partner account
- Accounts created or elevated recently in the orchestrator
- Configuration pushed to edges outside change windows — the strongest signal, as with the two previous CVEs
- Abnormal requests to the orchestrator's UI and API, especially parameters carrying SQL syntax, in the logs of the proxy or WAF in front of it
- Host activity: unusual processes, files and outbound connections
Like the previous entries, the KEV listing points to the forensic triage requirements of directive BOD 26-04: patching alone isn't the whole job.
Mitigation
- Hosted instances: nothing to do for this CVE, Arista already patched them.
- On-prem instances: move to the fixed build for your branch per advisory 0199 — the CISA deadline is October 26. If you stopped at September's versions, you're not covered.
- Audit orchestrator accounts: every account, even read-only, is a way in for this flaw. Remove the ones nobody uses and enforce MFA.
- Restrict access to the management interface to admin networks and the edges themselves.
- If in doubt: review the configuration pushed to every edge, and rotate operator credentials, activation keys and certificates.
Why continuous monitoring of your network orchestration matters
Three critical CVEs in KEV in three months on the same product, with bounds that rise each time. "We patched VeloCloud" is no longer an answer: you need to know which version is running and check it against every new entry.
With cveo.tech, inventory your SD-WAN orchestrators and controllers with their exact versions, and get an alert as soon as a CISA KEV entry affects them.