Arista VeloCloud Orchestrator SQL Injection (CVE-2026-114625) Added to CISA KEV — Actively Exploited

What Happened

Arista has disclosed a SQL injection vulnerability (CVE-2026-114625) affecting on-premises deployments of VeloCloud Orchestrator (VCO). According to Arista's advisory, the flaw may allow a remote attacker to access privileged internal functionality and impact the VCO host, potentially compromising the confidentiality, integrity, and availability of the orchestrator and the data it manages. CISA has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, indicating it is being actively exploited in the wild. No CVSS score has been published at this time, and Arista has not released details on the specific injection point or attack chain.

Why It Matters

VeloCloud Orchestrator is the central management plane for Arista's SD-WAN deployments, meaning an attacker who compromises it could gain control over SD-WAN edge configuration and traffic across an organization's network. SQL injection against a management-plane application is a high-value target: successful exploitation could expose credentials, configuration data, or provide a foothold for further lateral movement into the orchestrated network fabric. The KEV designation means federal agencies and, by extension, any organization running on-prem VCO should treat this as an urgent remediation priority rather than routine patch-cycle work.

Who Is Affected

• Organizations running on-premises (self-hosted) Arista VeloCloud Orchestrator
• Note: the advisory specifies on-prem VCO; cloud-hosted/SaaS VCO exposure is not addressed in the available details

What Defenders Should Do Now

• Check Arista's advisory for affected VCO versions and apply the vendor-supplied patch or upgrade immediately
• Review VCO access logs for anomalous or unexpected query patterns, unusual admin API/UI activity, or requests with SQL metacharacters in parameters
• Audit network exposure of the VCO management interface — restrict access to trusted management networks/VPNs only, and confirm it is not reachable from the general internet
• Monitor for unexpected new admin accounts, privilege changes, or configuration modifications on the orchestrator following any suspected exposure window
• Validate backups/configuration exports of VCO are current in case rollback or forensic comparison is needed

Developing Intel

This is a same-day, developing item based on Arista's advisory and the CISA KEV listing published 2026-10-23. Technical specifics — affected version ranges, patch availability, and indicators of compromise — may be updated by the vendor or CISA as investigation continues. For authoritative, up-to-date details, consult Arista's official advisory: Arista Security Advisory 0199.