Arista Security Advisory 0199 fixes CVE-2026-114625, an SQL injection (CWE-89, CVSS 3.1 9.9, CVSS 4.0 9.4) in on-prem VeloCloud Orchestrator, the SD-WAN management portal formerly sold by Broadcom. Any authenticated user, down to the lowest Enterprise Read Only role, can gain operator privileges and masquerade as the local superuser operator, reaching internal-only functionality and impacting the VCO host. Arista detected the issue itself and says it is actively exploited. Fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12; hosted and Dedicated VCO are already patched; end-of-support trains were not assessed (contact TAC). VCO is exposed by default. Until upgraded: restrict the web UI to admin networks, block 74.82.197.86 and 38.54.50.151, and review admin activity. VeloCloud Gateway and Edge and EOS products are not affected.