CVE-2026-114625VulnerabilityPublished 10/23/2026

VeloCloud Orchestrator SQL Injection Vulnerability

Affects Arista VeloCloud OrchestratorSource AlienVault OTX General

Severity

Medium

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 10/23/2026
KEV deadline: 10/26/2026
EPSS: 0.6% chance of exploitation in 30 days – higher than 45% of CVEs

What to do

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected software

Product	Affected	Fixed in
GitHub Actionsvelocloud/orchestrator`pkg:github/velocloud/orchestrator`Other threats	Affected >=5.2.0 <5.2.3.18 >=6.1.0 <6.1.3.10 >=6.4.0 <6.4.2.12	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

VeloCloud Orchestrator (VCO) on-premises versions contain a critical SQL injection vulnerability that allows authenticated users with minimal privileges, such as those with the Enterprise Read Only role, to escalate their access to superuser operator level. This flaw enables unauthorized access to privileged internal functionality, potentially compromising the confidentiality, integrity, and availability of the orchestrator and its managed data. The vulnerability is actively exploited in the wild, with specific malicious IP addresses identified. Fixed versions have been released for affected VCO versions 5.2.x, 6.1.x, and 6.4.x. Hosted and dedicated VCO instances have already been patched. Immediate upgrade to the fixed releases is recommended, along with restricting web interface access and monitoring for suspicious activity.

Summary

The VeloCloud Orchestrator on-premises software contains a critical SQL injection vulnerability (CVE-2026-114625) that permits authenticated users with minimal privileges, specifically those assigned the Enterprise Read Only role, to escalate their privileges to superuser operator access. This escalation allows attackers to access privileged internal functions, which may lead to compromise of the orchestrator's confidentiality, integrity, and availability. The vulnerability affects VCO versions 5.2.x prior to 5.2.3.18, 6.1.x prior to 6.1.3.10, and 6.4.x prior to 6.4.2.12. The vulnerability is actively exploited, with malicious IP addresses 74.82.197.86 and 38.54.50.151 identified as sources of attacks. Hosted and dedicated VCO instances have been patched by the vendor. The vendor advisory recommends immediate upgrading to fixed versions and restricting access to the web interface to mitigate exploitation.

Impact

Exploitation of this vulnerability allows an authenticated user with minimal privileges to escalate to superuser operator access on the VeloCloud Orchestrator. This can lead to unauthorized access to privileged internal functionality, potentially compromising the confidentiality, integrity, and availability of the orchestrator and the data it manages. Active exploitation in the wild has been observed, increasing the urgency of remediation.

Mitigation

Fixed releases are available for affected VCO versions: 5.2.x prior to 5.2.3.18, 6.1.x prior to 6.1.3.10, and 6.4.x prior to 6.4.2.12. Immediate upgrade to these fixed versions is strongly recommended. Hosted and dedicated VCO instances have already been patched by the vendor. Additionally, restrict access to the web interface to trusted users only and monitor for suspicious activity to reduce risk of exploitation.

Weaknesses

CWE-89SQL Injection (opens in a new tab)

Indicators of compromise

IP addresses 2

74.82.197.86
38.54.50.151

CVEs 1

CVE-2026-114625