Critical CVE-2026-114625 Affects Arista Networks VeloCloud Orchestrator

## Overview CVE-2026-114625 affects the Arista Networks VeloCloud Orchestrator (VCO). This vulnerability has a CVSS score of 9.4, indicating a critical severity level. It allows authenticated users to gain operator privileges, potentially compromising the orchestrator's functionality and the data it manages. ## Technical Details The vulnerability exists in the on-premises version of VeloCloud Orchestrator. Authenticated users can exploit this flaw to masquerade as a local "superuser operator." This access enables them to utilize internal functions that should not be accessible remotely. The issue impacts both hosted and dedicated versions of VCO. Arista Networks has already released patches for the affected systems. ## Impact Successful exploitation of CVE-2026-114625 can lead to significant risks. Attackers may compromise the confidentiality, integrity, and availability of the orchestrator and its managed data. The ability to access privileged internal functionality poses a severe threat to organizations using the affected VCO versions. ## Mitigation Defenders should prioritize applying the latest patches provided by Arista Networks. Immediate updates will help secure the VCO against this vulnerability. Regularly review user access levels and monitor for any unauthorized changes to system privileges. Implementing strict authentication measures can further reduce the risk of exploitation.