Catalog analysis: CISA added this entry on October 23, 2026. The entry reflects catalog information retrieved on October 23, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.
What the vulnerability is
CVE-2026-114625 is a SQL injection vulnerability (CWE-89) affecting Arista VeloCloud Orchestrator. This flaw allows a remote attacker to access privileged internal functionality, which could lead to a compromise of the confidentiality, integrity, and availability of both the orchestrator host and the data it manages.
Exposure and applicability
This vulnerability specifically applies to on-premises deployments of the Arista VeloCloud Orchestrator. Organizations utilizing cloud-hosted versions should refer to vendor guidance regarding their specific deployment model. Because this is a remote entry point, assets with direct internet exposure are at higher risk. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog as of October 23, 2026.
Remediation priorities
Our analysis suggests prioritizing remediation based on the asset’s network visibility and the sensitivity of the managed data.
- Immediate Patching: Infrastructure owners should apply mitigations according to Arista’s official security advisory. For federal agencies, CISA has established a compliance deadline of October 26, 2026.
- Forensic Triage: Given that this vulnerability is listed in the KEV catalog and requires forensic triage, defenders should examine logs for unauthorized access to privileged internal functions before or during the patching process.
- Exposure Reduction: If immediate patching is not feasible, restricting network access to the orchestrator management interface to trusted IP ranges could reduce the likelihood of remote exploitation.
How to validate remediation
To verify that exposure has been reduced, defenders should move beyond simple version checks:
* Configuration Audit: Confirm that the specific mitigations detailed in Arista advisory 24838 have been applied and are active on the host.
* Access Validation: Verify that the orchestrator is no longer reachable from unauthorized network segments if perimeter controls were implemented as a compensating measure.
* Log Review: Ensure that forensic triage has been completed to confirm no indicators of compromise existed prior to the update.
Limits and open questions
A version check alone does not prove that the system is secure or that the vulnerability has been fully mitigated in a specific environment. It remains unknown whether this flaw has been utilized by ransomware campaigns. Additionally, while patching addresses the known SQL injection path, residual risk may remain if other unpatched vulnerabilities exist within the same privileged internal functionality.
Source and editorial note
CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability · Source date: October 23, 2026 · Retrieved October 23, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗