Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114625— Security Advisory 0199

Quick assessment

Affected
Arista Networks VeloCloud Orchestrator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

VeloCloud Orchestrator（VCO）本地部署版本存在一个安全漏洞，该漏洞可能允许远程攻击者访问特权内部功能，并对 VCO 主机造成影响。成功利用该漏洞可能会破坏编排器及其所管理数据的机密性、完整性和可用性。 在受影响的系统中，任何已认证用户均可获取操作员权限，并伪装为本地"superuser operator"（超级用户操作员）。这包括访问仅限内部使用的功能，而这些功能原本设计为不可远程访问。 包括专用版在内的托管版 VCO 同样受到影响，但目前已完成修复。

CVSS 9.9 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114625

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Security Advisory 0199
Source: CVE Program / CVE List V5
Vulnerability Description
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Arista Networks VeloCloud Orchestrator 5.2.0 ~ 5.2.3.18 -

II. Public POCs for CVE-2026-114625

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114625

请登录查看更多情报信息。

Other References for CVE-2026-114625 (1)

IV. Related Vulnerabilities

Same vendor: Arista Networks
Same weakness: CWE-89

V. Comments for CVE-2026-114625

No comments yet

Leave a comment