Read the docs
TI-2026-79524 Aliases CVE-2026-114625GHSA-964w-6mm5-rm95

Privilege escalation in Arista VeloCloud Orchestrator on-premises

Priority CRITICAL 100Exploited in the wildCWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

VeloCloud Orchestrator on-premises from 5.2.0 before 5.2.3.18, from 6.1.0 before 6.1.3.10 and from 6.4.0 before 6.4.2.12 has an SQL injection flaw (CWE-89). Any authenticated user can gain operator privileges and pose as the local superuser operator, reaching internal functions not meant for remote access. Successful exploitation can compromise the orchestrator and its data. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-23.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-23CISA due date 2026-10-26
EPSS 0.01025 63rd percentileScored 2026-11-07
Fix Fixed VeloCloud Orchestrator (Arista Networks): 5.2.3.18, 6.1.3.10, 6.4.2.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AristaVeloCloud Orchestrator5.2.0 to before 5.2.3.18; 6.1.0 to before 6.1.3.10; 6.4.0 to before 6.4.2.125.2.3.18, 6.1.3.10, 6.4.2.12Patch availableCNA
  • VeloCloud Orchestrator VendorArista Affected 5.2.0 to before 5.2.3.18; 6.1.0 to before 6.1.3.10; 6.4.0 to before 6.4.2.12 Fixed in 5.2.3.18, 6.1.3.10, 6.4.2.12 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*5.2.0 to before 5.2.3.18; 6.1.0 to before 6.1.3.10; 6.4.0 to before 6.4.2.12VulnerableArista
  • cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* Versions 5.2.0 to before 5.2.3.18; 6.1.0 to before 6.1.3.10; 6.4.0 to before 6.4.2.12 Vulnerable ·Arista

Remediation

Upgrade VeloCloud Orchestrator to 5.2.3.18, 6.1.3.10 or 6.4.2.12, depending on the release line, as described in Security Advisory 0199. CISA requires U.S. federal agencies to fix it by 2026-10-26.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA VeloCloud Orchestrator (Arista Networks) Fixed in 5.2.3.18, 6.1.3.10, 6.4.2.12

Timeline

  1. 2026-10-23 Added to CISA KEV
  2. 2026-10-23 Threatist record created from CVE-2026-114625
  3. 2026-10-23 Alias added: GHSA-964w-6mm5-rm95
  4. 2026-10-23 CISA SSVC decision points changed
  5. 2026-10-23 Priority changed: MEDIUM → CRITICAL
  6. 2026-10-24 EPSS moved to the 50th–90th percentile
  7. 2026-10-24 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-63212 Improper input validation in Arista VeloCloud Orchestrator On-Prem KEVCVSS 4.0CRITICAL 9.5
  • TI-2026-13992 VeloCloud Orchestrator OS Command Injection KEVCVSS 4.0CRITICAL 10.0
  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2020-03471 SQL injection in VMware SD-WAN by VeloCloud CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences