Critical Vulnerability in Arista Networks VeloCloud Orchestrator

## Overview Arista Networks disclosed a critical vulnerability in the VeloCloud Orchestrator (VCO) affecting on-premises installations. The vulnerability, tracked as CVE-2026-114625, has a CVSS score of 9.4, indicating high severity. This issue allows authenticated users to access privileged internal functionality, potentially compromising the VCO host. ## Technical Details The vulnerability enables any authenticated user to gain operator privileges. This access allows users to masquerade as a local "superuser operator." The functionality exposed by this vulnerability is intended for internal use only and should not be accessible remotely. The flaw affects both hosted and dedicated versions of VCO, but Arista has already issued patches for these versions. ## Impact Successful exploitation of this vulnerability can lead to significant risks, including the compromise of the confidentiality, integrity, and availability of the orchestrator and the data it manages. Attackers can leverage this access to manipulate configurations, exfiltrate sensitive data, or disrupt services. Organizations using affected versions of VCO should prioritize addressing this vulnerability to mitigate potential threats. ## Mitigation Defenders should immediately apply the patches provided by Arista Networks to all affected VeloCloud Orchestrator installations. Additionally, organizations should review user access controls to limit the number of authenticated users with operator privileges. Regular audits of user permissions and monitoring for unusual activity can further enhance security posture against this and similar vulnerabilities.