U .S. CISA has added a critical vulnerability in Arista’s VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2026-114625 with a CVSS score of 9.4, affects on‑premises VCO deployments and is linked to a SQL Injection weakness that can allow an authenticated attacker to gain operator privileges and impersonate a local superuser account.
The advisory notes that the vulnerability enables access to internal functions not intended for remote use, potentially compromising the orchestrator and the data it manages. Hosted VCO versions, including Dedicated deployments, are affected but have reportedly been patched.
Administrators should treat VCO as vulnerable by default: an attacker would need web interface access and a valid account, with even the lowest‑privilege Enterprise Read Only account being sufficient to exploit. CISA’s guidance calls for prompt action under Binding Operational Directive 22-01, with federal agencies required to remediate by 26 October 2026.
Evidence and practical response recommended by the advisory include reviewing web access logs for unusual or encoded requests, monitoring for attempts to access internal services, and blocking known malicious IPs such as 74.82.197[.]86 and 38.54.50[.]151. Organisations are advised to collect relevant logs and timestamps before recovery where possible, and to consult the KEV catalog for further steps to mitigate exposure.