CISA ADDS ACTIVELY EXPLOITED ARISTA VELOCLOUD ORCHESTRATOR SQL INJECTION VULNERABILITY TO KEV CATALOG

THREAT SUMMARY

Category: Actively Exploited SQL Injection Vulnerability
Affected Product(s): Arista VeloCloud Orchestrator On-Prem
CVE: CVE-2026-114625
CVSS: 9.9 Critical (v3.1); 9.4 Critical (v4.0)
Weakness: CWE-89 — SQL Injection
Primary Risks: Unauthorized operator privileges, local superuser impersonation, access to internal functionality, and potential compromise of orchestrator systems and managed data
Threat Status: Active exploitation confirmed by CISA and Arista
Affected Environment(s): Vulnerable on-premises VeloCloud Orchestrator installations
Attack Vector: Remote exploitation through the VCO web interface requiring an authenticated user
CISA Action: Added to the KEV Catalog on October 23, 2026
Required Response: Apply supported fixes, review exposure and potential compromise, and follow applicable BOD 26-04 requirements for federal systems.

---

CISA has added CVE-2026-114625, an SQL injection vulnerability affecting Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities Catalog after determining that the flaw is being actively exploited.

The October 23 addition places CVE-2026-114625 into a higher operational priority because exploitation is no longer theoretical. CISA has evidence that malicious actors are already using the vulnerability, which means organizations operating potentially affected Arista VeloCloud Orchestrator environments should identify exposure, apply applicable remediation, and determine whether systems remained vulnerable during the period of active exploitation.

SQL injection vulnerabilities can become serious when attacker-controlled input reaches database queries without adequate validation or parameterization. Depending on the affected implementation, successful exploitation can allow unauthorized interaction with backend database functions, potentially exposing, altering, or otherwise affecting stored information. The specific consequences depend on the vulnerable component, database privileges, application architecture, and conditions required for exploitation.

CISA’s October 23 alert confirms active exploitation but provides limited technical detail. Arista Security Advisory 0199 identifies affected software versions, severity scores, authentication requirements, confirmed privilege-escalation capabilities, and indicators associated with observed attacks. The publicly available information does not establish the identity of the threat actors or the full extent of any resulting compromise.

---

Vulnerability Details

CVE-2026-114625 — Arista VeloCloud Orchestrator SQL Injection Vulnerability

CVE-2026-114625 is a critical SQL injection vulnerability affecting Arista VeloCloud Orchestrator On-Prem. Arista assigned the flaw a CVSS v3.1 score of 9.9 and a CVSS v4.0 score of 9.4, both classified as Critical. The vulnerability is tracked under CWE-89.

According to Arista Security Advisory 0199, successful remote exploitation requires an authenticated user. An attacker with an authenticated account, including one holding Enterprise Read Only privileges, can obtain operator privileges and impersonate a local superuser operator.

This access can expose internal functionality that is not intended to be remotely accessible. Arista warns that successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages.

Arista confirmed that the vulnerability is being actively exploited. CISA subsequently added it to the Known Exploited Vulnerabilities Catalog on October 23, 2026.

---

Affected Product and Environments

Arista identifies the following VeloCloud Orchestrator On-Prem releases as vulnerable:

Release train	Vulnerable versions	Fixed version
5.2.x	Before 5.2.3.18	5.2.3.18 or later in the 5.2 train
6.1.x	Before 6.1.3.10	6.1.3.10 or later in the 6.1 train
6.4.x	Before 6.4.2.12	6.4.2.12 or later in the 6.4 train

Hosted VeloCloud Orchestrator deployments, including Dedicated environments, were also affected but have already been patched, according to Arista.

The vendor has not assessed end-of-support software versions. Organizations operating unsupported installations should contact Arista Technical Assistance Center to determine available upgrade options.

Security teams should verify exact build numbers across production, standby, disaster-recovery, and test environments. An installation should not be considered remediated until its running version has been confirmed against the relevant fixed release.

---

Operational Impact

The central operational concern is CISA’s confirmation of active exploitation.

Organizations routinely manage large vulnerability backlogs across endpoints, servers, cloud infrastructure, network appliances, applications, and management systems. KEV inclusion provides defenders with a practical signal that a vulnerability has moved into demonstrated offensive use and should receive elevated attention.

For CVE-2026-114625, the weakness involves SQL injection. That class of vulnerability directly concerns the relationship between an application and the database behind it. If exploitation allows an attacker to manipulate database queries, the impact can extend beyond the application interface itself depending on available privileges and the structure of the underlying environment.

Arista confirms that successful exploitation can allow an authenticated attacker to obtain operator privileges and impersonate a local superuser operator, potentially exposing sensitive management functionality and affecting the confidentiality, integrity, and availability of the orchestrator and its managed data. The advisory does not establish that every successful attack results in unrestricted data theft, lateral movement, or complete compromise of connected infrastructure.

The correct operational response is therefore to treat active exploitation as the reason for rapid remediation while avoiding unsupported assumptions about the precise post-exploitation capabilities.

---

Why KEV Status Matters

CISA’s Known Exploited Vulnerabilities Catalog is intended to help organizations prioritize vulnerabilities that are already being used in real-world attacks.

For a vulnerability to qualify for potential inclusion in the KEV Catalog, CISA states that it must have:

• A CVE identifier.
• Evidence of exploitation.
• Clear mitigation guidance.

CVE-2026-114625 has met those conditions.

That means organizations should not treat the vulnerability as an ordinary future maintenance item. Attackers have already demonstrated interest in exploiting the flaw, making remediation urgency different from a vulnerability for which no exploitation evidence exists.

KEV status does not eliminate the need to evaluate asset criticality, exposure, system configuration, and surrounding controls. It does provide direct evidence that the vulnerability has moved beyond theoretical risk.

For organizations managing large remediation backlogs, that evidence should influence patching order and investigative priority.

---

Federal Response

The October 23 addition falls under Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk.

BOD 26-04 establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies and reinforces the role of the KEV Catalog in identifying vulnerabilities that require priority action.

Under the directive, federal agencies must prioritize rapid remediation of high-risk KEV vulnerabilities, particularly those affecting publicly exposed assets where exploitation can provide total control of the affected asset. The directive allows lower-risk vulnerabilities to receive deferred action when they do not meet the same operational threshold.

BOD 26-04 also establishes basic expectations for determining when agencies should assess whether threat actors compromised a system before remediation was completed.

That requirement is important because applying an update or mitigation closes the vulnerable condition going forward but does not establish whether the system was already accessed while the vulnerability remained exploitable.

CISA encourages organizations outside the federal government to adopt the same risk-based vulnerability-management approach and prioritize KEV-listed vulnerabilities.

---

Defensive Guidance

Organizations running affected VeloCloud Orchestrator On-Prem installations should upgrade to the applicable fixed release identified in Arista Security Advisory 0199.

Until remediation is completed, Arista recommends the following defensive measures:

• Restrict access to the VCO web interface to trusted administrative networks.
• Monitor for connections involving the identified attacking IP addresses.
• Investigate unusual outbound network activity from the VCO host.
• Consider restricting outbound ports not required for normal operations.
• Monitor for unauthorized background services and webshells.
• Review recent administrator activity for unexpected changes.
• Preserve relevant forensic evidence when compromise is suspected.

Organizations should verify that the installed build actually contains the correction. Unsupported installations require additional assessment and consultation with Arista regarding available upgrade paths.

---

Compromise Assessment

Arista has identified two IP addresses observed conducting attacks involving CVE-2026-114625:

• 74.82.197.86
• 38.54.50.151

The vendor recommends blocking these addresses and examining VeloCloud Orchestrator web access logs for associated activity.

Security teams should investigate unusual URL path components, encoded characters, references to internal or local services, and unexpectedly high request rates. These observations may help identify suspicious activity involving the VCO web interface.

When compromise is suspected, relevant evidence should be preserved before remediation where operationally feasible. Arista specifically identifies VCO web access logs, backend application logs, system logs, database logs, and relevant filesystem timestamps as important investigative records.

Investigators should also examine unauthorized administrative changes, unexpected outbound connections, possible webshells, and suspicious background services.

The absence of connections to the published addresses does not independently establish that a system was never exploited.

---

Publicly Exposed Systems Require Priority Attention

BOD 26-04 places particular emphasis on high-risk KEV vulnerabilities affecting publicly exposed federal assets when successful exploitation can grant total control of the affected system.

The same defensive principle applies more broadly.

An internet-facing management system presents an attacker with a remotely discoverable target. If the vulnerable function is reachable from an untrusted network, the opportunity for scanning and exploitation can be greater than for a system isolated behind internal controls.

Organizations operating Arista VeloCloud Orchestrator should identify whether affected interfaces are publicly exposed and determine whether that exposure is operationally necessary.

Reducing unnecessary external access does not replace remediation. It can reduce the number of available attack paths while the underlying vulnerability is being addressed.

---

30-Day Outlook

The immediate response period should focus on asset discovery, remediation, validation, and compromise assessment across potentially affected Arista VeloCloud Orchestrator environments.

Organizations should expect the following areas to remain important:

• Continued identification of potentially affected deployments.
• Accelerated remediation of publicly exposed instances.
• Review of administrative and database-related activity before patching.
• Examination of secondary, legacy, test, and disaster-recovery systems.
• Additional compromise assessments where systems remained vulnerable during the exploitation period.
• Continued use of the KEV Catalog as a prioritization mechanism for confirmed exploited vulnerabilities.
• Monitoring for revisions to vendor security guidance, newly disclosed exploitation activity, and additional forensic findings that could affect remediation or incident-response priorities.

The most significant residual risk may come from overlooked systems. A primary production deployment can be remediated while a secondary management instance, older environment, or third-party-operated system remains vulnerable.

Organizations should therefore verify remediation against the complete asset inventory rather than relying only on the status of the most visible production environment.

---

TRJ Verdict

CISA’s October 23 addition of CVE-2026-114625 places an SQL injection vulnerability affecting Arista VeloCloud Orchestrator into confirmed active exploitation status.

The vulnerability presents a critical threat to affected management infrastructure because Arista confirms that an authenticated attacker can exploit the SQL injection weakness to obtain operator privileges and impersonate a local superuser operator. This capability can expose sensitive orchestrator functionality and create significant risks to the confidentiality, integrity, and availability of managed environments. The confirmed privilege escalation establishes a serious security concern without assuming that every exploitation attempt results in complete infrastructure compromise.

What is confirmed is sufficient for immediate response. CISA has evidence that exploitation is occurring, and organizations operating potentially affected Arista VeloCloud Orchestrator systems should identify vulnerable deployments, apply appropriate remediation, verify that corrective action succeeded, and assess systems that remained exposed before the vulnerability was addressed.

Federal agencies must follow the risk-based requirements established under BOD 26-04. Organizations outside the federal government have the same practical reason to prioritize the vulnerability because active exploitation has already moved the issue beyond theoretical risk.

The October 23 addition reinforces a broader cybersecurity principle: centralized management and orchestration systems require the same rigorous protection as the environments they administer. When a management platform becomes vulnerable, the system responsible for coordinating infrastructure can itself become part of the attack surface.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---