CVE-2026-114625Vulnerability
Arista VeloCloud Orchestrator SQL Injection Vulnerability
Reported by 7 independent sources · first reported by The Hacker News · last reported
Last reported today
Fix due 26 Oct 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 45% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
8 reports, newest first · the exact sentence from each-
U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog“Cybersecurity and Infrastructure Security Agency (CISA) added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog.”
-
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud“CVE-2026-114625 (CVSS score: 9.9) - An SQL injection vulnerability in on-premise versions of Arista VeloCloud Orchestrator that could allow a remote attacker to access privileged internal functionality.”
-
Arista Networks security advisory (AV26-1080)“Arista Networks indicates that CVE-2026-114625 is exploited in the wild.”
-
CISA Adds One Known Exploited Vulnerability to Catalog“CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability”
-
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months“The critical-severity security defect is tracked as CVE-2026-114625 (CVSS score of 9.9) and is described as a remotely exploitable SQL injection.”
-
CVE-2026-114625: Actively Exploited VeloCloud Orchestrator Flaw Grants Superuser Access“CVE-2026-114625: Actively Exploited VeloCloud Orchestrator Flaw Grants Superuser Access”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“[Arista Networks CVE-2026-114625]”
-
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks“The flaw is tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale.”
Indicators reported together
named in the same reports- 74.82.197[.]86in 5 reports
- 38.54.50[.]151in 5 reports
- 6.1.3[.]10in 4 reports
- 6.4.2[.]12in 4 reports
- 5.2.3[.]18in 2 reports
- railway[.]comin 1 report
- 5.2.3[.]16in 1 report
- 6.1.3[.]7in 1 report
- 6.4.2[.]8in 1 report
- pylos[.]coin 1 report
- infosec[.]exchangein 1 report
- masto.deoan[.]orgin 1 report
- sheogorath.bsky[.]socialin 1 report
- chaos[.]socialin 1 report
Copy these 14 indicators · defanged
Also named with it: CVE-2026-16812, CVE-2026-93952, CVE-2026-110447, CVE-2026-110264
Thanks — we review every report.