---
title: Arista VeloCloud Orchestrator zero-day CVE-2026-114625 (CVSS 9.9) exploited: any logged-in user can become superuser operator on on-prem VCO | ctxsec
url: https://ctxsec.com/items/arista-velocloud-vco-cve-2026-114625-zero-day
description: ""
status: "confirmed (Arista Security Advisory 0199, Oct 22; actively exploited per Arista)"
published: 2026-10-22
---

> 

[← Cybersecurity News](/news) · [markdown](/items/arista-velocloud-vco-cve-2026-114625-zero-day.md)

confirmed (Arista Security Advisory 0199, Oct 22; actively exploited per Arista)

2026-10-22

### Arista VeloCloud Orchestrator zero-day CVE-2026-114625 (CVSS 9.9) exploited: any logged-in user can become superuser operator on on-prem VCO

Arista Security Advisory 0199 fixes **CVE-2026-114625**, an SQL injection (CWE-89, CVSS 3.1 **9.9**, CVSS 4.0 9.4) in on-prem **VeloCloud Orchestrator**, the SD-WAN management portal formerly sold by Broadcom. Any authenticated user, down to the lowest _Enterprise Read Only_ role, can gain operator privileges and masquerade as the local superuser operator, reaching internal-only functionality and impacting the VCO host. Arista detected the issue itself and says it is **actively exploited**. Fixed in **5.2.3.18**, **6.1.3.10** and **6.4.2.12**; hosted and Dedicated VCO are already patched; end-of-support trains were not assessed (contact TAC). VCO is exposed by default. Until upgraded: restrict the web UI to admin networks, block `74.82.197.86` and `38.54.50.151`, and review admin activity. VeloCloud Gateway and Edge and EOS products are not affected.

Sources: [Arista Security Advisory 0199](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199) · [BleepingComputer](https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/)