Arista VeloCloud Orchestrator
CVE-2026-114625: privilege escalation in VeloCloud Orchestrator on-premises.
On an affected VeloCloud Orchestrator, any authenticated user can gain operator privileges and masquerade as the local superuser operator, reaching functions meant for internal use only. CISA lists it as exploited; hosted instances were patched by the vendor.
Exploitation
- Exploitation
- Exploited in the wild
- CISA KEV
- Listed 23 Oct 2026
- Federal due date 26 Oct 2026; catalogue read 31 Oct 2026
- EPSS
- 1.0% in 30 days
- Percentile 63%, scored 29 Oct 2026
- 9.4Critical, (CVSS 4.0)Scored by NVD
- 1.0%EPSS, chance of exploitation in 30 daysPercentile 63%; scored 29 Oct 2026
- 22 OctPublished by NVD22 Oct 2026; record read 26 Oct 2026
Versions
Affected and fixed.
.
| Affected | Fixed in |
|---|---|
| VeloCloud Orchestrator before 5.2.3.18 | 5.2.3.18 |
| VeloCloud Orchestrator before 6.1.3.10 | 6.1.3.10 |
| VeloCloud Orchestrator before 6.4.2.12 | 6.4.2.12 |
What to do now
Upgrade on-premises orchestrators to a fixed build and review operator activity before the fix. The October list sits in our digest.
How to check exposure
The orchestrator's version prints in its administration view. The NVD configuration gives 5.2.3.18, 6.1.3.10 and 6.4.2.12 as the first fixed builds on each branch, and the Arista security advisory 0199, referenced from the NVD record, carries the detail. Hosted and dedicated hosted orchestrators were already patched by the vendor according to the record.
The exposure is an orchestrator reachable by its own users: the flaw needs an account, and then no further trick.
Who this reaches in Australia
VeloCloud is the software-defined wide area network that Australian retailers, logistics firms and multi-site health groups run in place of private circuits. The orchestrator configures every edge, so operator rights on it are rights over every site's network path.
Under the Essential Eight the fix is patch applications for an internet-facing service within 48 hours, and restrict administrative privileges covers the accounts that can sign in to the orchestrator at all.
Timeline
Disclosed, published, listed, advised.
- : Published by NVD
- : Added to the CISA Known Exploited Vulnerabilities Catalog
- : CISA due date for US federal agencies
- : NVD record last modified
Questions, answered.
Is CVE-2026-114625 exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities Catalog on 23 October 2026 with a 26 October due date for US federal agencies.
Are hosted orchestrators affected?
The NVD description says hosted, including dedicated, versions were impacted and have already been patched. The remaining exposure is the on-premises orchestrator a customer runs itself.
Which builds fix it?
The NVD configuration ends the affected ranges at 5.2.3.18, 6.1.3.10 and 6.4.2.12. the Arista advisory 0199 names the release for each branch.
Provenance
Sources, and when they were read.
Every source was read 31 Oct 2026.
- 1NVD, CVE-2026-114625NIST. US Government work, public domain.
- 2CISA, Known Exploited Vulnerabilities CatalogUS Government work, public domain.
- 3FIRST, EPSS score for CVE-2026-114625EPSS terms of use.
- 4Black Shard, Essential Eight assessment
- 5Black Shard, Exploited in October 2026: Ivanti, Windows, PAN-OS, Cisco and Ahsay lead 26 additions