CISA adds Arista VeloCloud Orchestrator SQL injection flaw to KEV catalog

CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on October 23, 2026.

The record describes a SQL injection issue in the on-premises edition of Arista VeloCloud Orchestrator. Remote attackers could reach internal privileged functions and affect the host system running the software.

Arista rates the flaw 9.9 under CVSS 3.1 and 9.4 under CVSS 4.0. Arista serves as the CNA for both scores. NVD has not scored this CVE.

Successful exploitation could affect confidentiality, integrity, and availability for the orchestrator along with data it manages.

Attackers need a valid login. Arista says a successful attack requires network access to the VCO web interface and a valid authenticated session. The minimum role is Enterprise Read Only, the lowest built-in tenant role, and any authenticated user on an affected system can gain operator privileges and masquerade as a local "superuser operator" user. Arista says no configuration prevents the exposure, and that it detected the issue and knows it is being actively exploited.

Fixed releases are out. The flaw is fixed in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12 and later in each train. Hosted VCO, including Dedicated instances, was also affected and has already been patched.

Arista lists interim mitigations. Until a fixed release is deployed, Arista advises restricting access to the VCO web interface to trusted administrative networks, monitoring for access from known malicious IPs, watching for unexpected outbound traffic from the VCO host, blocking outbound ports not needed for normal activity, checking for backdoor daemons and webshells, and reviewing recent administrator activity for unexpected changes.

CISA sets a remediation deadline of October 26, 2026. Organizations must apply mitigations according to vendor instructions and comply with BOD 26-04 guidance on prioritizing security updates based on risk.

Stakeholders must evaluate each asset's internet exposure and follow the directive's patching guidelines. For cloud services, they must either apply the guidance or discontinue use of the product if mitigations are unavailable.

The bulletin lists one CVE. The entry notes unknown ransomware campaign use. The vendor advisory appears among the links supplied in the CISA record.