CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability
Summary
Arista VeloCloud Orchestrator has a SQL injection vulnerability (CVE-2026-114625) that could allow remote attackers to access privileged functions and compromise the orchestrator and its data. Arista has provided mitigation instructions, and federal agencies must apply them by October 26, 2026, following CISA's risk-based patching guidance.
IFF Assessment
The identified SQL injection vulnerability allows remote attackers to access privileged functions and impact the confidentiality, integrity, and availability of the orchestrator and its managed data, representing a significant threat to defenders.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 26, 2026. Known ransomware use: Unknown.
Defender Context
This vulnerability highlights the ongoing risk of SQL injection in critical infrastructure management tools. Defenders should prioritize patching this vulnerability and similar issues on any Arista VeloCloud Orchestrator instances they manage. It also underscores the importance of CISA's BOD 26-04 guidance for risk-based patch prioritization.