Arista VeloCloud Orchestrator Critical Flaw Grants Superuser Access to Authenticated Users
Authenticated users can exploit CVE-2026-114625 in on-premises Arista VeloCloud Orchestrator to gain superuser access and compromise host integrity.
Key points
- The flaw is a security issue rated Critical with a CVSS score of 9.9.
- Any authenticated user can escalate privileges to masquerade as a local superuser operator.
- On-premises versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected.
Arista Networks VeloCloud Orchestrator contains a critical security issue that allows remote attackers to access privileged internal functionality. The vulnerability, tracked as CVE-2026-114625, impacts on-premises deployments where authenticated users can bypass intended access controls. Successful exploitation compromises the confidentiality, integrity, and availability of the orchestrator and its managed data.
Root cause
The issue is classified as CWE-89. Attackers can manipulate requests to access internal functionality that is not intended for remote use. This allows them to gain operator privileges. The flaw enables privilege escalation from a standard authenticated state to a higher operational level, potentially impacting the VCO host.
Attack path
An attacker must first possess valid credentials for any user account on the system. Once authenticated, they can exploit the security issue to gain operator privileges. This allows the attacker to masquerade as a local superuser operator. This elevated access grants control over internal features, potentially leading to full compromise of the VCO host and its managed environment.
Affected versions
- Arista Networks VeloCloud Orchestrator before 5.2.3.18
- Arista Networks VeloCloud Orchestrator before 6.1.3.10
- Arista Networks VeloCloud Orchestrator before 6.4.2.12
Mitigation
- Update on-premises VeloCloud Orchestrator installations to version 5.2.3.18 or later.
- Update on-premises VeloCloud Orchestrator installations to version 6.1.3.10 or later.
- Update on-premises VeloCloud Orchestrator installations to version 6.4.2.12 or later.
- Note that hosted and Dedicated versions have already been patched by the vendor.
Detection notes
Security teams should monitor authentication logs for unusual privilege changes or role assignments. Look for standard users executing commands typical of superuser accounts. Database audit logs may reveal unexpected queries or injection attempts. Check for new administrative sessions originating from user accounts that rarely perform such actions. Isolate affected systems immediately if suspicious activity is confirmed to prevent lateral movement.
What to do and how to stay safe: Arista Networks
- Inventory all on-premises VeloCloud Orchestrator instances to identify versions prior to the patched releases.
- Review access logs for any authenticated users who recently gained operator or superuser privileges.
- Restrict network access to the orchestrator management interface to trusted administrative subnets only.
- Monitor for successful logins followed by immediate execution of high-privilege commands.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the hosted version of VeloCloud Orchestrator affected by this vulnerability?
No, hosted and Dedicated versions of VCO were impacted but have already been patched by the vendor.
What is the CVSS score for CVE-2026-114625?
The vulnerability has a CVSS score of 9.9, which is rated as Critical severity.
Do attackers need credentials to exploit this flaw?
Yes, the source material states that any authenticated user can exploit the issue to gain operator privileges.
