VeloCloud Orchestrator Patch Triage: Three Release Trains, One Critical SQL Injection
CVE-2026-114625 forces a straightforward but easily mis-scoped decision for anyone running Arista VeloCloud Orchestrator on premises: the fix exists, but only in three specific builds, and the train you are on determines whether a recent patch already covers you. This is a triage note for change advisory boards rather than a technical deep dive.
The version matrix
The CVE record lists the affected ranges by train:
- 5.2.0 and later, before 5.2.3.18
- 6.1.0 and later, before 6.1.3.10
- 6.4.0 and later, before 6.4.2.12 Fixed builds are 5.2.3.18, 6.1.3.10 and 6.4.2.12 respectively. Hosted and Dedicated orchestrators were impacted and have already been patched by the vendor, which leaves on-premises deployments as the group that must act.
The stale-patch trap
Two earlier VeloCloud Orchestrator flaws were exploited in 2026: CVE-2026-16812 in July and CVE-2026-93952 in September. Reporting notes that orchestrators carrying the fixes for those flaws remain vulnerable to CVE-2026-114625, because the earlier fixed releases sit below the new fixed builds on the same train. A host that is "fully patched" according to last quarter's change record can therefore still be exposed today.
Treat the earlier advisories as context, not as evidence of current safety.
What is not affected
VeloCloud Gateway and VeloCloud Edge are not affected by this CVE. Release trains outside the advisory list, including 7.0, are not listed as vulnerable. Arista states that releases which have reached end of support were not checked, so an unsupported train should be classified as unknown rather than safe, and routed to Arista TAC for an upgrade path.
CVSS in context
The CVE record carries CVSS 3.1 at 9.9 and CVSS 4.0 at 9.4. Both are critical, and both encode a network-reachable, low-complexity flaw with low privileges required. The privilege requirement is what changes the internal conversation: an attacker needs a login, which means credential hygiene, tenant offboarding and shared-account practices now sit inside the exploit path rather than outside it.
Change-window advice
If a maintenance window is days away, apply the network-side mitigations in the interim: restrict the orchestrator web interface to trusted administrative networks, block outbound ports that normal operation does not need, and review administrator activity for unexpected changes. These reduce reachability; they do not repair the injection.
After upgrading, confirm the running build matches the fixed version rather than trusting the change ticket, then re-check for the reported attacker addresses in the logs from the exposure window.
References
- Arista Security Advisory 0199: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
- CVE.org record for CVE-2026-114625: https://cveawg.mitre.org/api/cve/CVE-2026-114625
- The Hacker News, including the July and September 2026 VCO flaws: https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html
