CISA has added CVE-2026-114625, a critical SQL injection flaw in on-premises Arista VeloCloud Orchestrator (VCO), to its Known Exploited Vulnerabilities catalog, and federal agencies must act on it by October 26, 2026.
What Is It
CVE-2026-114625 is a SQL injection flaw (CWE-89) in Arista VeloCloud Orchestrator on-prem. Per the NVD record, it may let a remote attacker reach privileged internal functionality and affect the VCO host. On an affected system, any authenticated user can gain operator privileges and pose as a local "superuser operator" user. That includes functionality meant for internal use only, which was never meant to be reachable remotely.
Arista PSIRT rates it CVSS 3.1 9.9 (Critical), vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and CVSS 4.0 9.4 (Critical).
Why It Matters
CISA KEV confirms active exploitation. The entry was added on 2026-10-23, and CISA's SSVC assessment lists exploitation as "active" with "total" technical impact. The attack goes over the network, has low complexity and needs no user interaction. The only requirement is a low-privileged authenticated account. Successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.
CISA has flagged this entry for forensic triage. That means affected organizations are expected to check for compromise, not just patch. Known ransomware campaign use is listed as "Unknown."
What's Vulnerable
Arista VeloCloud Orchestrator On-Prem, in these version ranges:
- 5.2.0 up to (not including) 5.2.3.18
- 6.1.0 up to (not including) 6.1.3.10
- 6.4.0 up to (not including) 6.4.2.12
Hosted VCO, including Dedicated instances, was also affected but has already been patched by the vendor.
Patch Status
On-prem versions 5.2.3.18, 6.1.3.10 and 6.4.2.12 are the first releases outside the affected ranges in each branch. Arista's advisory (Security Advisory 0199) is tagged as including mitigation guidance.
CISA's required action: apply mitigations according to vendor instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Follow the BOD 26-04 guidance for cloud services, or stop using the product if mitigations are unavailable. Stakeholders must also assess each asset's internet exposure. The federal remediation due date is 2026-10-26.