CISA Adds Arista VeloCloud Orchestrator SQL Injection (CVE‑2026‑114625) to Known Exploited Vulnerabilities Catalog
CISA placed CVE‑2026‑114625, a critical SQL‑injection flaw in Arista VeloCloud Orchestrator, into its KEV catalog after confirming active exploitation. Organizations using the SD‑WAN orchestrator must prioritize patching and capture remediation evidence to meet audit and risk‑management expectations.
ADTP Breach Watch· October 23, 2026· CISA Advisories
The CVE‑2026‑114625 vulnerability in Arista VeloCloud Orchestrator allows unauthenticated attackers to execute arbitrary SQL commands, granting total control of the orchestrator backend. CISA added the flaw to its Known Exploited Vulnerabilities catalog based on observed exploitation activity.
Why it matters for trust and compliance
The KEV listing underscores the importance of a documented vulnerability‑management control that provides continuous evidence of risk‑based remediation, a signal that satisfies multiple compliance frameworks simultaneously.
Provides a concrete, verifiable control‑evidence point for vulnerability‑management programs.
Enables rapid, auditable remediation that can be mapped to NIST CSF and other frameworks.
Who is affected
CLOUD_INFRA
Recommended actions
Identify any unpatched VeloCloud Orchestrator instances in your environment.
Apply the vendor patch immediately and log the remediation ticket.
Map the patching activity to your vulnerability‑management control objective and store the evidence in your Trust Center.
Details
CVEs
CVE-2026-114625
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.