{
  "id": 16122435,
  "title": "Third VeloCloud Orchestrator Flaw Exploited in 2026: CVE-2026-114625 in a Pattern",
  "url": "https://urgent.news/2026/10/22/third-velocloud-orchestrator-flaw-exploited-in-2026-cve-2026-114625",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-22T23:23:03.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ioneyrezende/third-velocloud-orchestrator-flaw-exploited-in-2026-cve-2026-114625-in-a-pattern-4k72"
  },
  "original_language": "en",
  "account": "Arisota has reported three critical vulnerabilities in VeloCloud Orchestrator since late July 2026, all of which have been exploited. The latest, CVE-2026-114625, is an SQL injection flaw that allows any authenticated user, including low-level customer roles, to escalate to a superuser operator. This marks the third time the same management plane has produced critical flaws with delayed operational responses. The earlier vulnerabilities CVE-2026-16812 and CVE-2026-93952 were both rated lower on the CVSS scale and did not require authentication. The consistency in advisory language across the three vulnerabilities suggests a stable understanding of the asset, not a stable cause. The fact that orchestrators patched for earlier vulnerabilities remain vulnerable to CVE-2026-114625 indicates patch compounding. Arista states that hosted and dedicated orchestrators have been patched, but on-premises customers must apply specific fixes themselves. To improve security, organisations should shorten the interval between advisories and build verification, and treat the orchestrator's management interface as internet-exposed by default.",
  "summary": "Third VeloCloud Orchestrator Flaw Exploited in 2026: CVE-2026-114625 in a Pattern CVE-2026-114625 is the third VeloCloud Orchestrator vulnerability that Arista has reported as exploited since late July 2026. The repetition is the story: the same management plane keeps producing critical, network-reachable flaws, and the operational response keeps arriving after exploitation has begun. The…",
  "key_points": [
    "Third critical vulnerability CVE-2026-114625 exploited in VeloCloud Orchestrator",
    "SQL injection flaw allows low-level users to escalate to superuser operator",
    "Arista patched hosted and dedicated orchestrators, but on-premises customers must apply fixes"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}