Government Advisory

CISA Warns of Active Attacks on Arista VeloCloud Orchestrator SQL Injection Flaw

CISA · 23 Oct 2026

Key Takeaway Check whether you or your managed service provider run Arista VeloCloud Orchestrator, apply the vendor's fix as a priority, and use the KEV Catalog to decide which patches to do first.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. The flaw is tracked as CVE-2026-114625 and is a SQL injection vulnerability in Arista VeloCloud Orchestrator.

CISA notes that this type of vulnerability is a frequent attack vector for malicious cyber actors. The agency says it poses significant risks to the federal enterprise. US federal civilian agencies must follow Binding Operational Directive 26-04, which requires them to prioritise rapid fixes for KEV-listed vulnerabilities on publicly exposed assets that give an attacker total control once exploited. It also sets expectations for checking whether a system was compromised before a patch was applied.

The directive applies only to US federal agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and to prioritise fixing KEV Catalog vulnerabilities. Australian businesses that use Arista VeloCloud Orchestrator, or that rely on a provider who does, should treat this listing as a signal to act.

CISA KEV SQL injection Arista VeloCloud vulnerability management patching

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.