CVE-2026-114625: listed in the CISA KEV catalog

CVE-2026-114625 · CVSS 9.9 CRITICAL · KEV 2026-10-23 · patch available

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Is CVE-2026-114625 exploited?

• Listed in the CISA KEV catalog on 2026-10-23.
• Federal remediation due 2026-10-26.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Arista Networks · VeloCloud Orchestrator · >= 5.2.0, < 5.2.3.18, >= 6.1.0, < 6.1.3.10, >= 6.4.0, < 6.4.2.12

Is there a patch?

Yes. Update to one of these or later:

From Arista Networks's CVE record · Arista Networks advisory

What PlainSec published about CVE-2026-114625

• Collabora backdoors target credential stores as VCO flaws recur (2026-10-25)
• Arista VeloCloud flaw grants low-privilege users operator access (2026-10-24)

Primary sources

• NVD record
• CISA KEV catalog
• Arista Networks advisory

What this record does not say

• No EPSS score.

KEV and EPSS are re-checked daily. Record last updated 2026-10-24.