Arista VeloCloud Orchestrator CVE-2026-114625 (Security Advisory 0199, SQL injection to superuser, exploited zero-day, CISA KEV): which VCO versions fix it?

Am I affected? Yes if you run an on-premises VeloCloud Orchestrator (VCO), the management system for VeloCloud SD-WAN, on a release before: - 5.2.3.18 (5.2 train) - 6.1.3.10 (6.1 train) - 6.4.2.12 (6.4 train) CVE-2026-114625 (CVSS 9.9) is a SQL injection. Anyone with a valid portal login, even the lowest 'Enterprise Read Only' role, can raise their session to the local superuser operator role. Arista disclosed it on October 22, 2026 with exploitation already seen, and CISA added it to KEV. Arista-hosted and Dedicated VCOs have already been patched. It's the third exploited VCO zero-day since July, after CVE-2026-16812 and CVE-2026-93952, so check you have those fixes too. For the 7.0 train, see Arista Security Advisory 0199. How to check: - The VCO version is shown in the Operator portal (About / system information) or in the upgrade history. Fix: - Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later on your train. Interim mitigation (until upgraded): - Allow the VCO web interface only from trusted management networks or a VPN. - Because any customer login is enough: review and remove unused or shared enterprise accounts, enforce MFA/SSO where available, and reset passwords for accounts you can't vouch for. After upgrading (assume compromise if exposed while unpatched): - Search web and access logs for the source IPs Arista and researchers reported (74.82.197.86 and 38.54.50.151), unusual URL patterns with lots of encoded characters, and bursts of requests from a single session. - Look for new operator or superuser accounts, configuration pushes to edges you didn't make, unexpected outbound connections and unknown processes on the VCO. - Preserve logs before cleanup. Rotate operator credentials, API tokens and anything the orchestrator stores for edges and gateways. Sources: https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/ https://socradar.io/blog/velocloud-orchestrator-cve-2026-114625-active-exploitation/