Arista fixes third actively exploited VeloCloud flaw in three months

On October 22, 2026, Arista Networks patched a VeloCloud Orchestrator SQL-injection flaw, tracked as CVE-2026-114625 and rated 9.9 under CVSS v3.1, that attackers had already exploited. It is the third actively exploited VeloCloud Orchestrator vulnerability since summer, after an OS command-injection flaw in advisory 0144 on July 27 and another disclosed in advisory 0183 on September 22. Exploitation requires web-interface access and valid credentials; the flaw can elevate an Enterprise Read Only account, the lowest-privilege role, to operator and allow impersonation of a superuser. On-premises users of 5.2.x, 6.1.x and 6.4.x need builds 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later, while hosted and dedicated deployments were already patched.