Key points
- Arista Networks VeloCloud Orchestrator versions before 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected by CVE-2026-114625.
- The flaw allows any authenticated user to escalate privileges to a local superuser operator role.
- Hosted and Dedicated versions of the orchestrator have already been patched, but on-premises deployments remain at risk.
A critical security vulnerability in Arista Networks' VeloCloud Orchestrator allows remote attackers to bypass intended access controls and gain privileged internal functionality. According to the National Vulnerability Database record for CVE-2026-114625, this flaw carries a CVSS score of 9.9, classified as critical. The issue stems from a weakness identified as CWE-89, within the on-premises version of the software. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator itself, as well as the data it manages.
By the numbers
- CVSS 9.9: The severity rating assigned by the NVD, indicating a critical risk level for remote exploitation.
- CWE-89: The specific weakness category identified in the NVD record that underpins the vulnerability in the application code.
- Three version cutoffs: Affected releases include those before 5.2.3.18, before 6.1.3.10, and before 6.4.2.12.
What the figures mean
The high severity score reflects the critical nature of the remote privilege escalation. The NVD record indicates that any authenticated user can leverage this issue to masquerade as a local "superuser operator." This role provides access to internal functionality that was never intended to be remotely accessible.
Consequently, the breach of privilege allows an attacker to impact the VCO host directly. The NVD states that successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by it. The inclusion of three distinct version lines suggests that the flaw persisted across multiple release branches before being addressed in hosted environments.
What to watch
Security teams should monitor for anomalous privilege escalation events within their VeloCloud Orchestrator environments. Since the flaw allows authenticated users to gain superuser status, look for standard accounts suddenly performing administrative actions or accessing internal endpoints. The NVD notes that successful exploitation may impact the availability of the orchestrator, so watch for service disruptions or unusual restart patterns.
Additionally, audit logs for any unexpected changes to network policies or device configurations managed by the VCO. Because the vulnerability involves CWE-89, look for error messages or database query anomalies that might indicate an attacker is probing the application layer for entry points.
Infection and persistence in general
Teams usually encounter privilege escalation flaws when attackers exploit weak input validation or misconfigured roles. In this category of incident, analysts typically examine authentication logs to identify where a low-privilege account suddenly executed high-level commands. Persistence often relies on the attacker creating backdoor accounts or modifying system configurations to maintain access even after a reboot. Spreading is less common in this specific vector unless the compromised orchestrator is used to push malicious configurations to downstream devices. Check whether role-based access controls are strictly enforced and if internal APIs are properly isolated from external networks.
Background: Input validation
Input validation is the process of checking that data meets strict format, type, length, and range requirements before processing. It prevents injection attacks and logic bugs by ensuring the system only handles expected values. This defense operates at the application layer, complementing network controls and secure coding practices.
Read the full guide: Input Validation: How to Stop Bad Data at the Border
What to do and how to stay safe: Arista Networks
- Verify your current VeloCloud Orchestrator version against the affected list: before 5.2.3.18, before 6.1.3.10, and before 6.4.2.12.
- If you are running an on-premises deployment, isolate the VCO host from untrusted networks until you can apply vendor updates.
- Review audit logs for any authenticated users who have recently accessed internal functionality or elevated their privilege levels.
- Restrict access to the orchestrator interface to known administrative IPs and enforce multi-factor authentication for all user accounts.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Arista VeloCloud Orchestrator are vulnerable to CVE-2026-114625?
Versions before 5.2.3.18, before 6.1.3.10, and before 6.4.2.12 are affected by this critical remote privilege escalation flaw.
Is there a fix available for on-premises VeloCloud Orchestrator deployments?
The source material states that hosted and Dedicated versions have been patched, but does not confirm a specific patch release for on-premises versions.
What is the technical nature of the vulnerability in CVE-2026-114625?
It is a weakness identified as CWE-89 that allows authenticated users to access privileged internal functionality and act as a superuser.
