Arista: VeloCloud Orchestrator SQL injection gives operator rights from read-only login

Arista published Security Advisory 0199 for CVE-2026-114625, an SQL injection in VeloCloud Orchestrator rated 9.9 under CVSS 3.1 that the vendor says is actively exploited. Any authenticated user with the lowest tenant role, Enterprise Read Only, can gain operator privileges and impersonate a local superuser. Fixes are available in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12.

• CVE-2026-114625: CVSS 3.1 score 9.9, CVSS 4.0 score 9.4, CWE-89
• Exploitation needs only a session with the Enterprise Read Only role
• Patched in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12
• Arista: the web interface is exposed by default and no configuration prevents it