VDB
CVE-2026-114625
CVE-2026-114625
PUBLISHED
KEV
As of October 22, 2026, Arista Networks is affected by a vulnerability in the following product: VeloCloud Orchestrator (VCO) Prior to 5.2.3.18 Prior to 6.1.3.10 Prior to 6.4.2.12 Arista Networks indicates that CVE-2026-114625 is exploited in the wild. Update 1 On October 23, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-114625 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
EPSS 1.03% · 63.5th percentile
Risk Scores
EPSS Score
1.03%
63.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Prior | Prior to 6.1.3.10 | |
| Prior | Prior to 6.4.2.12 | |
| Prior | Prior to 5.2.3.18 |
Timeline
- Oct 22, 2026 VulnCheck KEV Exploitation
- Oct 22, 2026 CVE Published
- Oct 23, 2026 CISA KEV Added
- Oct 23, 2026 VulnCheck KEV Exploitation
- Oct 23, 2026 EPSS Score
- Oct 23, 2026 Coalition ESS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
References
- https://cyber.gc.ca/en/alerts-advisories/arista-networks-security-advisory-av26-1080 advisory
- https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 vendor
- https://www.arista.com/en/support/advisories-notices vendor
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625 advisory