Critical SQL injection vulnerability fixed in Arista VeloCloud Orchestrator (VCO) on-premises

Arista has fixed the critical vulnerability CVE-2026-114625 in VeloCloud Orchestrator (VCO) on-premises. An authenticated user with at least the Enterprise Read Only role can remotely exploit it to execute code, escalate privileges to operator level, and access internal superuser functions. Arista confirms that the vulnerability is actively exploited.