A CVSS score is a compressed argument. For CVE-2026-114625 in Arista VeloCloud Orchestrator, the CVE record carries two: CVSS 3.1 at 9.9 and CVSS 4.0 at 9.4. Both are critical, and reading the vectors explains why the vulnerability ranks where it does, and where the score stops being useful.

The 3.1 vector

The 3.1 string is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Translated: network reachable, low attack complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity and availability.
Scope changed is the part worth pausing on. It records that the vulnerable component and the impacted component are not the same security authority. The injection lands in the orchestrator's web application, while the consequence reaches throughout the platform the orchestrator manages.

The 4.0 vector

The 4.0 assessment is AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. It keeps network reachability, low complexity and low privileges, and adds high subsequent-system impact on all three properties. The stated attack requirements are none.

What the scores assume

Both scores assume an attacker has valid credentials. That is not a small caveat; it is the reason the score is high rather than trivial, and it is also the reason it understates the operational problem. Arista reports that the flaw is actively exploited and that the minimum role needed is Enterprise Read Only, the lowest built-in customer role. A scoring model built around privileges required does not capture how common a read-only login is in real deployments.

What the score cannot tell you

CVSS does not say whether your particular orchestrator is internet-facing. It does not say whether the flaw was exploited against a network like yours. And it does not measure how much authority the resulting operator session actually carries in your fabric, which depends on your tenant and partner structure.
For those questions you need your own asset data. A ZoomEye query for title="VeloCloud" returned 520 matching assets on 22 October 2026, which sizes visible product-family interfaces rather than confirmed vulnerable systems.

Turning the score into a decision

The vendor fix for on-premises deployments is 5.2.3.18, 6.1.3.10 or 6.4.2.12. Until then, Arista recommends restricting the orchestrator web interface to trusted administrative networks, blocking unneeded outbound ports, and watching for backdoor daemons and web shells.
A 9.9 with a verified exploitation report is a patch-now finding. The score's job is to start that conversation; the advisory, the credential inventory and the exploit evidence finish it.

References

  • CVE.org record with both CVSS vectors: https://cveawg.mitre.org/api/cve/CVE-2026-114625

  • Arista Security Advisory 0199: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

  • SecurityOnline coverage: https://securityonline.info/velocloud-orchestrator-cve-2026-114625-exploited/