Summary
generated automatically from NVD dataVeloCloud Orchestrator (VCO) on-prem, from Arista, has a flaw (classified as CWE-89) that lets any authenticated user gain operator privileges and impersonate a local "superuser operator", reaching internal-only functionality not meant to be remotely accessible. This could compromise the confidentiality, integrity and availability of the orchestrator host and its managed data. It is rated CRITICAL with a CVSS v3.1 score of 9.9 and is listed in the CISA KEV catalog as actively exploited; hosted and Dedicated VCO versions were already patched.
NVD description
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-10-23. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-10-26
EPSS · FIRST.org
1.0%probability of exploitation in the next 30 days
Higher than 63% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-25, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 22 oct. 2026
- Updated
- 24 oct. 2026
- Status
- Analyzed
- Source
- psirt@arista.com
Affected products
Weaknesses (CWE)
References (2)
- https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199MitigationVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-89
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.