CISA added CVE-2026-114625, the Arista VeloCloud Orchestrator SQL Injection Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalogue on 23 October 2026. The flaw affects on-premises Arista VeloCloud Orchestrator and may let a remote attacker access privileged internal functionality and affect the VCO host.
The vulnerability is a SQL injection flaw. Successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. It carries a CVSS score of 9.9, rated Critical. Patch status is unknown in the available data; Arista has published a security advisory with guidance for the vulnerability.
KEV inclusion indicates that CISA has confirmed active exploitation. The available data does not establish whether attackers have used the vulnerability in ransomware campaigns. CISA set a remediation deadline of 26 October 2026.
CISA requires organisations to apply mitigations in accordance with vendor instructions, while complying with BOD 26-04 guidance on prioritising security updates based on risk and its Forensics Triage Requirements. For cloud services, organisations should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must assess each asset’s internet exposure and follow BOD 26-04 patching guidance. The directive applies to Federal Civilian Executive Branch (FCEB) agencies; all organisations should review their exposure and take appropriate action.
See the linked NVD entry and CISA KEV catalogue for full details.