- Technical severity
- CRITICAL (9.4)
- Exploitation
- confirmed-in-the-wild-by-authority
- Exposure
- company-applicability-unknown
- Response priority
- accelerated
- Analytical confidence
- high
Assessment
CVE-2026-114625 affects Arista VeloCloud Orchestrator. CISA has confirmed inclusion in its known-exploited catalog. DualScope assigns accelerated response priority under the stated generic context; each company should recalculate that priority from actual inventory, exposure and compensating controls.
Evidence and claims
- confirmed: CISA lists CVE-2026-114625 in the Known Exploited Vulnerabilities catalog.
- attributed: NVD reports CVSS 9.4 (CRITICAL); this measures technical severity, not company-specific risk.
- attributed: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
- attributed: FIRST EPSS estimates a 1.0% probability of exploitation activity in the model window; this is a model estimate, not direct observation.
Company action plan
immediate · accelerated
Vulnerability management / asset owners
Applies when: The organization uses Arista VeloCloud Orchestrator; prioritize internet-facing instances.
Action: Identify affected deployments and compare installed versions with the vendor advisory or supported fixed release. Where applicable to the organization, consult CISA KEV required actions and deadlines; federal directives do not automatically impose obligations on every reader.
Dependencies: Authoritative asset inventory, product ownership and vendor advisory access.
Verify: Export the matched inventory with version and exposure evidence; have the service owner confirm false positives.
Residual risk: Unknown or unmanaged assets may remain exposed.
near-term · accelerated
Platform operations / change management
Applies when: An affected version is confirmed.
Action: Apply the vendor-supported fix or documented mitigation through normal emergency change controls. Preserve rollback and configuration backups.
Dependencies: Vendor fix guidance, maintenance window and tested rollback.
Verify: Re-scan the deployed version and validate service health and security-control telemetry after the change.
Residual risk: Remediation does not establish that prior compromise did not occur.
investigation · urgent
Detection engineering / incident response
Applies when: The vulnerable service was reachable during the exposure window or suspicious activity exists.
Action: Review vendor-recommended indicators and relevant authentication, process, network and administrative logs. Escalate anomalies under the incident-response plan.
Dependencies: Retained logs and vendor-supported detection guidance. Do not treat generic IP blocklists as proof.
Verify: Document query scope, time range, data gaps and investigation outcome separately from patch status.
Residual risk: Absence of observed indicators is not proof of absence when telemetry is incomplete.
What remains uncertain
- Company deployment and internet exposure are unknown.
What would change this assessment
- A vendor advisory changes affected or fixed versions.
- An authoritative source changes the CVE status or exploitation assessment.
- New direct incident evidence changes the known attack prerequisites or impact.
Sources and methodology
- cisa-kev · retrieved October 27, 2026
- nvd-cve · retrieved October 27, 2026
- first-epss · retrieved October 27, 2026
DualScope uses deterministic automated analysis of public sources. It does not claim firsthand testing, private telemetry or interviews.