CISA Adds Exploited Arista VeloCloud Orchestrator Flaw to KEV
Tech GuruQuick Answer
CISA added Arista VeloCloud Orchestrator CVE-2026-114625 to KEV on October 23. Inventory on-premises VCO, preserve evidence, upgrade each supported train to its fixed release, complete required forensic triage by October 26 where applicable, validate control-plane behavior, and retain proof.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory on-premises VCO deployments, exact release trains and builds, web-interface exposure, user and administrator accounts, hosted-versus-customer-managed status, logs, owners, backups, and recovery dependencies. Match each on-premises VCO to the three affected release boundaries. Hosted and dedicated VCO were affected but Arista says they are patched; VeloCloud Edge and Gateway and the other products Arista lists are not affected. Do not infer compromise from version presence alone. Preserve evidence, then upgrade to VCO 5.2.3.18, 6.1.3.10, or 6.4.2.12 or later in the corresponding supported train. Contact Arista TAC for unsupported trains, restrict the web interface to trusted administrative networks, and complete CISA-required forensic triage by October 26 where applicable. Confirm the running VCO release, review web access, backend application, system, database and file-system evidence for suspicious activity, check administrator changes and unexpected outbound traffic or persistence, test orchestrator workflows, and retain upgrade and investigation evidence.
Last verified: 2026-10-24 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Arista VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom) |
|---|---|
| Advisory | Security Advisory 0199 / CISA KEV: CVE-2026-114625 |
| CVE | CVE-2026-114625 |
| Authoritative release date | 2026-10-23 19:30:18.920900 UTC |
| Authority revision date | 2026-10-23 19:30:18.920900 UTC |
| Affected versions | VCO 5.2.x before 5.2.3.18, VCO 6.1.x before 6.1.3.10, and VCO 6.4.x before 6.4.2.12. End-of-support releases have not been assessed; hosted and dedicated VCO were affected but Arista says they are patched. |
| Fixed version | VCO 5.2.3.18 or later in the 5.2 train, 6.1.3.10 or later in the 6.1 train, or 6.4.2.12 or later in the 6.4 train |
| CVSS base score | 9.9 (CVSS v3.1); 9.4 (CVSS v4.0) |
| CVSS severity | Critical |
| Exploitation status | Known exploited: confirmed by Arista and CISA KEV; ransomware campaign use is Unknown.; no exploitation claim is inferred. |
What Changed
Arista disclosed authenticated SQL injection in on-premises VeloCloud Orchestrator that can grant operator privileges and access to internal functionality. Arista says it is actively exploited, and CISA added the CVE to KEV with forensic triage required for covered organizations.
What To Validate Now
- Inventory. Inventory on-premises VCO deployments, exact release trains and builds, web-interface exposure, user and administrator accounts, hosted-versus-customer-managed status, logs, owners, backups, and recovery dependencies.
- Establish applicability. Match each on-premises VCO to the three affected release boundaries. Hosted and dedicated VCO were affected but Arista says they are patched; VeloCloud Edge and Gateway and the other products Arista lists are not affected. Do not infer compromise from version presence alone.
- Remediate. Preserve evidence, then upgrade to VCO 5.2.3.18, 6.1.3.10, or 6.4.2.12 or later in the corresponding supported train. Contact Arista TAC for unsupported trains, restrict the web interface to trusted administrative networks, and complete CISA-required forensic triage by October 26 where applicable.
- Validate. Confirm the running VCO release, review web access, backend application, system, database and file-system evidence for suspicious activity, check administrator changes and unexpected outbound traffic or persistence, test orchestrator workflows, and retain upgrade and investigation evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Known exploitation does not prove a particular VCO was compromised. Preserve evidence before remediation, investigate persistence independently of patch state, avoid relying only on observed source-IP blocks, and coordinate recovery if unauthorized operator access is found.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
