Arista Networks, Inc.

(New York Stock Exchange)
Back to all articles
Bearish -65

CVE-2026-114625: CVSS 9.9 Hits Arista VeloCloud [2026]

Security vulnerability AI-generated analysis

🚨 Arista Networks published an emergency advisory for CVE-2026-114625, a critical SQL injection flaw in the VeloCloud Orchestrator (VCO) On-Premises management plane.

πŸ“‰ The vulnerability carries a CVSS v3.1 score of 9.9 and allows authenticated low-privilege users to escalate to operator-level privileges and impersonate superuser accounts.

⚠️ CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 23, 2026, establishing a hard deadline for federal agencies and all enterprises.

πŸ”„ This is the third actively exploited zero-day in VeloCloud Orchestrator within roughly four months, indicating sustained attacker interest in the platform.

πŸ› οΈ Arista's Hosted and Dedicated VCO offerings were already patched before public disclosure, leaving On-Premises installations as the primary exposure.

πŸ”’ The flaw is confined to the management plane, allowing attackers to compromise policy control across entire branch networks without touching edge devices directly.

πŸ“… A follow-up advisory on October 24 addressed a related certificate-validation issue (CVE-2026-111943), requiring further version upgrades for full remediation.

πŸ’Ό The incident forces Arista customers into emergency patch cycles, compressing standard maintenance windows and increasing operational friction for security teams.

🏒 While VeloCloud traffic-forwarding hardware remains unaffected, the centralization of policy in VCO makes it a high-value target for ransomware and intrusion sets.

πŸ“‰ Repeated critical flaws in the inherited VeloCloud codebase may negatively impact Arista's reputation and future SD-WAN procurement conversations with enterprise clients.

Risk Factors
  • Arista Networks faces a critical SQL injection vulnerability (CVE-2026-114625) in its VeloCloud Orchestrator that allows privilege escalation from low-privilege users to superuser accounts.
  • The U.S. Cybersecurity and Infrastructure Security Agency has added the flaw to its Known Exploited Vulnerabilities catalog, confirming active exploitation and forcing immediate remediation.
  • This incident represents the third actively exploited zero-day in VeloCloud Orchestrator within four months, signaling potential structural weaknesses in the software's security lifecycle.
  • The vulnerability is concentrated entirely in On-Premises deployments, creating significant exposure for enterprises managing their own data centers or private clouds.
  • A follow-up advisory issued 48 hours later regarding certificate validation issues requires customers to re-evaluate their patch status, complicating the remediation timeline.
  • The centralization of network policy in the compromised orchestrator allows attackers to control branch networks without directly attacking edge devices, amplifying the blast radius.
  • Arista's inherited VeloCloud codebase has a history of critical flaws, which may lead enterprises to question the vendor's secure development lifecycle during future procurement evaluations.
Full Analysis
Arista Networks issued an emergency security advisory on October 22, 2026, addressing CVE-2026-114625, a critical SQL injection vulnerability in its VeloCloud Orchestrator (VCO) On-Premises management plane. The flaw carries a CVSS v3.1 score of 9.9 and allows an authenticated, low-privilege user to escalate privileges to a 'superuser operator' level, effectively hijacking the central control system for thousands of corporate wide-area networks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on October 23, mandating immediate patching for federal agencies and signaling a critical urgency for all enterprises. This incident marks the third actively exploited zero-day in the VeloCloud Orchestrator within a four-month period, suggesting a persistent attacker interest and potential structural weaknesses in the software's input validation and session authorization mechanisms. While Arista has already patched its Hosted and Dedicated VCO offerings, the exposure is concentrated on organizations running VCO On-Premises. The vulnerability resides in the management plane rather than the data plane, meaning a single compromised orchestrator could grant attackers administrative control over policy across an entire branch network without directly touching edge devices. A follow-up advisory published two days later addressed a related certificate-validation issue, further tightening the patch requirements to specific version builds. The operational impact for Arista involves forcing customers into emergency patch cycles, compressing standard maintenance windows and change-control approvals into days. While Arista's broader business relies heavily on cloud and AI data center networking rather than the inherited VeloCloud line, this cluster of critical vulnerabilities in management software poses a significant reputational risk and may influence future procurement decisions regarding SD-WAN orchestration platforms.