What is CVE-2026-114625?

Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

CISA added this issue to its exploited-vulnerability catalog on 2026-10-23. This is the catalog date, not this article’s publication date.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-114625 — NVD, CVE-2026-114625 — CVE Program record

First, confirm where the vulnerable product is running

CVE-2026-114625 describes a SQL injection vulnerability in Arista VeloCloud Orchestrator (VCO) on-prem that allows authenticated users to escalate to operator/superuser privileges and access internal-only functionality, potentially compromising the VCO host and managed data. The vendor advisory confirms hosted and dedicated VCO versions were impacted and have already been patched by Arista. For on-premises deployments, customers must apply vendor-provided mitigations per Security Advisory 0199. CISA BOD 26-04 requires risk-based prioritization and forensics triage. No fixed version is established in the supplied catalog; verify the exact version and upgrade path in the linked Arista advisory. Cloud deployment models (marketplace images, Kubernetes, appliances) and managed service exposure are not established by the sources.

The named vulnerable product is Arista VeloCloud Orchestrator. Deployment on a cloud platform does not by itself establish that a managed AWS, Azure or GCP service is vulnerable. Confirm the product, version, vendor-supported deployment and remediation owner.

Vendor remediation comes first

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Use the current vendor advisory for affected versions and fixed builds. This catalog entry does not establish a universal fixed version or a cloud-specific hotfix.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-114625 — NVD

AWS: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Identify any customer-managed EC2 instances or VMware Cloud on AWS workloads running VCO on-prem; confirm the VCO version against the Arista advisory.
  2. Do not rely on AWS Systems Manager Patch Manager for this appliance; Arista appliances require vendor-supported upgrade procedures, not OS-level patching.
  3. If VCO is deployed via a third-party marketplace image, verify the publisher's update cadence and apply the vendor fix; AWS does not manage the application layer.
  4. Check VPC security groups and network ACLs to restrict management-plane access to VCO; limit exposure to trusted administrative networks only.

Sources: AWS Systems Manager Patch Manager

Azure: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Inventory Azure VMs or Azure Arc-connected servers hosting VCO on-prem; match the running version to the Arista advisory for the required upgrade.
  2. Azure Update Manager handles OS updates only; it does not patch Arista vendor appliances. Follow the Arista-supported upgrade path for VCO.
  3. If VCO runs in a customer-managed container on AKS, verify the container image source and rebuild/redeploy using a vendor-fixed image tag.
  4. Review NSGs and Azure Firewall rules to ensure the VCO management interface is not internet-exposed; restrict to authorized admin subnets.

Sources: Azure Update Manager overview

GCP: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. List Compute Engine VMs or GKE nodes running customer-managed VCO on-prem; confirm the version against the Arista Security Advisory 0199.
  2. VM Manager Patch applies OS packages only; it cannot update the VCO application. Use the Arista-provided upgrade method for the appliance.
  3. For containerized VCO on GKE, confirm the image registry and tag; redeploy using a vendor-supplied fixed image; do not assume a managed service is affected.
  4. Verify VPC firewall rules and IAP settings to ensure the VCO management plane is accessible only from approved administrative CIDRs.

Sources: Google Cloud VM Manager — About Patch

How to verify the fix

  1. Log into the VCO management UI or CLI and report the running version; compare to the fixed version specified in Arista Security Advisory 0199.
  2. Confirm the upgrade completed successfully by checking post-upgrade release notes or version output; ensure no rollback occurred.
  3. Validate that operator/superuser privilege escalation paths are closed by attempting a known-safe authentication test with a non-admin account.
  4. Review VCO audit logs for any anomalous privileged-access events before and after the upgrade; retain logs per forensics triage requirements.

Questions teams ask

Does this CVE affect Arista-hosted or Dedicated VCO instances?

The vendor advisory states hosted and dedicated VCO versions were impacted and have already been patched by Arista. No customer action is required for those deployment models.

What is the fixed version for on-prem VCO?

The supplied catalog does not list a fixed version. Consult Arista Security Advisory 0199 (linked in the CVE record) for the exact version and upgrade instructions.

Can I use my cloud provider's patch manager (SSM, Azure Update Manager, VM Manager) to fix this?

No. These tools manage OS-level packages only. VCO is a vendor appliance/application; you must follow Arista's supported upgrade procedure.

Is VCO deployed as a managed service on AWS/Azure/GCP affected?

Applicability to any managed cloud service is not established by the sources. Check with the specific service provider and the Arista advisory for your deployment model.

Sources & further reading

This brief summarizes public source material. Confirm affected versions and the current vendor instructions before changing production. No original exploit validation is claimed.