Arista VeloCloud Orchestrator SQL Injection Vulnerability
Arista — VeloCloud Orchestrator
- Added to KEV catalog
- 23 October 2026
- Federal remediation due date
- 26 October 2026
- Weakness classification (CWE)
- CWE-89
AI Breakdown
What it is
Arista VeloCloud Orchestrator contains a SQL injection vulnerability in its on-premises installations. A remote attacker can exploit this flaw to reach privileged internal functionality and gain control over the host. This compromises the confidentiality, integrity, and availability of both the orchestrator and the data it manages.
Why it matters
Because this flaw is listed as an actively exploited vulnerability, attackers can use it to compromise critical network management infrastructure. While use in ransomware campaigns is currently unknown, the potential impact on underlying network operations is severe. Federal agencies have been instructed to remediate the vulnerability by October 26, 2026.
Recommended action
IT teams should immediately evaluate the internet exposure of their orchestrator assets and apply vendor mitigations in accordance with CISA BOD 26-04 guidance. Administrators must also follow CISA forensics triage requirements and relevant cloud service directions. If vendor mitigations are unavailable, organizations should discontinue use of the product.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-114625
More Arista Vulnerabilities
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services