ZeroDayAlert

CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability

Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

Arista VeloCloud Orchestrator Added to KEV 2026-10-23 Federal due 2026-10-26 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

This vulnerability affects Arista VeloCloud Orchestrator deployments running on premises. The record does not specify which versions are vulnerable, only that the on-prem variant is affected; cloud-hosted deployments may have different exposure. SQL injection in the orchestrator allows remote attackers to bypass authentication controls and reach privileged functions, potentially compromising the confidentiality, integrity and availability of the orchestrator itself and all SD-WAN appliances it manages.

How to check whether this touches you

  • Audit your inventory for any on-premises VeloCloud Orchestrator instances. If you run only cloud-hosted VCO or have already decommissioned on-prem deployments, note that and move to patch prioritisation for any remaining systems.
  • Establish network reachability: check whether your VCO instances accept inbound connections from untrusted networks, whether directly exposed to the internet or via jump hosts or VPNs without MFA gating.
  • Attempt to connect to the management interface and note the software version string displayed. Version alone is not proof of vulnerability (vendors backport fixes), but it is the starting point for vendor-specific patch guidance.
  • Review Arista's security advisories and patch documentation to determine which specific versions contain the vulnerability and which patches address it.

What to do

  1. Immediately consult Arista's published guidance for CVE-2026-114625 to identify your precise version and the corresponding patch or workaround. Do not assume all versions are equally at risk.
  2. If you cannot patch within the federal remediation window (26 October 2026), apply network-layer mitigations: restrict inbound access to the VCO management interface to known administrator IP ranges, disable unnecessary network services, and require VPN or jump-host access with multi-factor authentication.
  3. Enable and retain detailed audit logs from the VCO instance, focusing on authentication failures, SQL query errors, and privilege escalation attempts. Log retention should extend back at least 90 days.
  4. If the VCO cannot be patched or adequately isolated, escalate to your risk owner to evaluate whether the orchestrator should remain in service and, if so, under what conditions and monitoring.

If you find you were exposed

Exploitation of SQL injection typically occurs weeks or months before disclosure, so retrospective hunting must work backwards from the vulnerability publication date. Query your VCO and network access logs for suspicious SQL syntax in request parameters, unusual database queries, unauthorised privilege grants, or access from unexpected source IPs to the management interface. If logs do not extend back far enough, engage your incident response team to assess the blast radius of the orchestrator's managed appliances, which may have been reconfigured or used as pivot points during the window of exposure.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-114625 is being exploited. It cannot tell you whether VeloCloud Orchestrator is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →