What to fix first for CVE-2026-114625: a practical sequence for VeloCloud Orchestrator owners

Arista reported CVE-2026-114625, a critical SQL injection in VeloCloud Orchestrator with a CVSS score of 9.9. This vulnerability is exploited in the wild and requires a valid login at Enterprise Read Only or higher. The flaw allows authenticated low-privilege users to act as local superusers on the orchestrator. Furthermore, attackers may impact the VCO host, potentially exposing, modifying, or disrupting the orchestrator and managed data. Fixed releases are available per-train to address this exposure.