SB2026102360 - Authenticated SQL injection in Arista VeloCloud Orchestrator

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102360

SB2026102360 - Authenticated SQL injection in Arista VeloCloud Orchestrator

Published: October 23, 2026

Security Bulletin ID SB2026102360
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) SQL injection (CVE-ID: CVE-2026-114625) Exploited

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to improper neutralization of special elements used in SQL commands in VeloCloud Orchestrator (VCO) when processing input from the web interface. A remote user can submit crafted input that alters SQL queries to gain operator privileges, impersonate a local superuser operator, and access internal functionality that can affect the VCO host.

Note, the vulnerability is being actively exploited in the wild.


Remediation

Install update from vendor's website.

References