CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection and CISA KEV Response

Introduction

Short answer:** CISA added CVE-2026-114625, an Arista VeloCloud Orchestrator SQL-injection vulnerability, to its Known Exploited Vulnerabilities Catalog on 23 October 2026 based on evidence of active exploitation. Organizations using VeloCloud Orchestrator should identify exposed management interfaces, apply the vendor’s supported remediation, review logs and credentials, and treat the KEV listing as a reason to prioritize—not as proof that every installation was compromised.

**Key Takeaways**

- The issue affects a management and orchestration layer, so exposure review is as important as version checking.

- CISA’s KEV inclusion is based on active-exploitation evidence.

- Do not expose orchestrator administration directly to the public internet unless the architecture explicitly requires it and compensating controls are verified.

- Review authentication, administrative activity, unexpected configuration changes and outbound connections.

- CISA’s federal deadline does not automatically create a private-sector deadline, but it is a useful risk-prioritization signal.

What CISA’s KEV addition means

CISA’s 23 October alert says CVE-2026-114625 is an Arista VeloCloud Orchestrator SQL-injection vulnerability and that it was added to the KEV Catalog because there is evidence of active exploitation. The catalog is designed to help organizations prioritize vulnerabilities that have moved beyond theoretical risk.

The alert does not say that every VeloCloud customer was compromised. It also does not replace Arista’s product-specific update guidance. The correct response is to combine the KEV signal with your own asset inventory, version information, exposure and logs.

Why an orchestrator deserves priority

An SD-WAN orchestrator can influence policies, sites, tunnels, users and device configuration. A weakness in that layer may therefore have a wider blast radius than a vulnerability in one isolated endpoint. The security team should map who can reach the management plane, which identity providers are connected and which network changes can be made from it.

India-based organizations should include branch offices, managed service links, cloud management networks and disaster-recovery tenants in the review. Old administrative URLs in monitoring systems and firewall exceptions are common sources of forgotten exposure.

Defensive response checklist

1. Identify every VeloCloud Orchestrator instance, version, tenant and management endpoint.

2. Confirm whether management access is internet-facing, VPN-only, allowlisted or reachable through a third-party service.

3. Apply Arista’s supported fix or mitigation for the exact deployment version.

4. Review administrative logins, configuration changes, API activity, database errors and unusual outbound connections.

5. Rotate potentially exposed administrative credentials through the approved identity process if investigation supports it.

6. Check whether policies, routes, certificates or user roles changed unexpectedly.

7. Preserve relevant logs before retention windows expire and escalate evidence of compromise through the incident process.

8. Verify that branch connectivity and segmentation still work after remediation.

Avoid unsafe “testing”

Do not send SQL-injection payloads to a production orchestrator. Use the vendor’s advisory, an approved non-production environment and a documented validation plan. A scanner result alone is not proof of exploitation, and a clean result does not prove that a vulnerable version was never exposed.

What to monitor after patching

Track failed administrative authentication, new privileged accounts, unexpected policy pushes, configuration export activity, unusual API calls and management-plane access from unfamiliar networks. Compare the timeline with legitimate maintenance windows. If evidence indicates compromise, isolate according to your response plan before making changes that could erase evidence.

FAQ

### Is CISA KEV the same as a patch instruction for every company?

No. CISA’s catalog is a strong prioritization signal. Organizations should use the vendor’s exact update guidance and their own risk and change processes.

### Does KEV inclusion prove my VeloCloud tenant was hacked?

No. It establishes exploitation evidence for the vulnerability, not compromise of every installation.

### Should the orchestrator be internet-facing?

That depends on the architecture, but management interfaces should be minimized and strongly controlled. Review exposure and access paths rather than assuming a default is safe.

Conclusion

CVE-2026-114625 belongs near the front of a VeloCloud remediation queue because CISA has recorded active-exploitation evidence. Inventory the orchestrator, reduce unnecessary management exposure, apply the supported update, investigate the relevant logs and verify policy integrity. Keep the response defensive and evidence-led.

Internal reading

• [Identity attacks and MFA bypass](/articles/identity-attacks-mfa-bypass)
• [Network segmentation explained](/articles/network-segmentation-explained)
• [Incident response: the first hour](/articles/incident-response-first-hour)

Decision checklist

• [Identity attacks and MFA bypass](/articles/identity-attacks-mfa-bypass)
• [Network segmentation explained](/articles/network-segmentation-explained)
• [Incident response: the first hour](/articles/incident-response-first-hour)

Limitations

• Reporting channels, procedures and security guidance can change; verify current instructions before acting.

Evidence sources

1. cisa.gov — CISA Adds CVE-2026-114625 to KEV
2. cve.org — CVE-2026-114625 Record
3. cisa.gov — CISA Known Exploited Vulnerabilities Catalog
4. cisa.gov — CISA Vulnerability Prioritization Guidance