Arista VeloCloud Orchestrator flaw exploited (CVE-2026-114625)

CISA has added CVE-2026-114625, a critical SQL injection flaw in the on-premises Arista VeloCloud Orchestrator (VCO), to its Known Exploited Vulnerabilities (KEV) catalog, which means it is being exploited in the wild. The federal remediation deadline is 26 October 2026, so on-prem operators should treat this as a same-day task. The listing is recorded in the CISA KEV catalog.

What happened

CISA added the Arista VeloCloud Orchestrator SQL Injection Vulnerability on 23 October 2026. NVD published the CVE record on 22 October 2026. According to the description, a remote attacker may be able to reach privileged internal functionality and affect the VCO host. Successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and of the data it manages.

The vulnerability is weakness type CWE-89 (SQL injection: attacker-controlled input is interpreted as part of a database query). NVD lists a CVSS 4.0 base score of 9.4, rated critical, with the vector AV:N/AC:L/AT:N/PR:L/UI:N: network reachable, low complexity, and low privileges required, with no user interaction.

Am I affected?

• On-prem VCO: affected. The entry applies to the on-premises Arista VeloCloud Orchestrator.
• Hosted VCO, including Dedicated: the advisory text says these were impacted and have already been patched, so no customer action is described for them.
• Affected version ranges: not listed in the NVD data we reviewed. Check the Arista security advisory for the exact builds and fixes.

Technical details

On an affected system, any authenticated user can gain operator privileges and masquerade as a local “superuser operator” user. That includes access to functionality meant for internal use only and not intended to be reachable remotely. The attacker therefore needs a valid account first, but the bar for that account is low.

• KEV status: added 2026-10-23, due date 2026-10-26.
• Known ransomware campaign use: listed as Unknown.
• EPSS: 0.00555 (EPSS estimates the probability of exploitation activity in the next 30 days). This is low, but KEV listing confirms exploitation has already been observed, which outweighs a predictive score.
• Attacker details, victims and indicators of compromise: not disclosed in the sources we reviewed.

Why this matters

This section is our analysis, not new reporting. An SD-WAN orchestrator is a central management plane. If an attacker takes operator control, they may be able to see or change what the orchestrator manages, and they sit on a host that normally has broad trust inside the network. A low-privilege starting point also means a stolen or weak ordinary account may be enough, so exposure of the management interface to the internet raises the risk considerably.

Because the flaw is in KEV, prioritise it above ordinary critical findings: plan to mitigate within hours rather than waiting for a regular patch window.

How to fix CVE-2026-114625

CISA’s required action is to apply mitigations in accordance with vendor instructions and to follow its BOD 26-04 guidance on prioritising security updates based on risk, plus its forensics triage requirements. For cloud services it says to follow applicable BOD 26-04 guidance, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure.

Detection and hunting ideas

No indicators have been published in the data we reviewed, so these ideas follow from the vulnerability type rather than from observed attacks:

• Review VCO authentication logs for ordinary users suddenly performing operator-level actions.
• Look for new or changed operator accounts and for configuration changes you did not make.
• Check web and application logs on the orchestrator for unusual database error messages or odd characters in request parameters.
• Review connections from the VCO host to destinations it does not normally contact.

What to do

1. Identify every on-prem VeloCloud Orchestrator instance, including test and lab systems.
2. Open the Arista advisory and apply the vendor mitigations or fixed release before the 26 October 2026 deadline.
3. Restrict access to the orchestrator management interface to trusted networks or a VPN while you work.
4. Audit and rotate credentials for all VCO user accounts, and remove accounts you do not recognise.
5. Follow CISA’s forensics triage requirements to check for signs of prior compromise before assuming the system is clean.
6. If you rely on the hosted service, confirm with Arista that your tenant has been patched.

Related coverage

• Siemens Software Center DLL flaw exploited (CVE-2026-110936)
• Plex Media Server flaw exploited, added to CISA KEV (CVE-2026-96656)
• Zammad session fixation flaw CVE-2026-102489 exploited, CISA KEV

Sources

• CISA Known Exploited Vulnerabilities catalog: CVE-2026-114625
• NVD: CVE-2026-114625
• Arista security advisory 0199