CISA KEV Adds Arista VeloCloud Orchestrator CVE-2026-114625 to Catalog

CISA added CVE-2026-114625, an SQL injection flaw in the Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities catalog on October 23, 2026. The addition follows confirmation of active exploitation in the wild. Arista Networks disclosed the issue one day earlier in Security Advisory 0199.

CISA KEV Catalog Entry Details and Technical Impact

The vulnerability affects on-premises VeloCloud Orchestrator instances, the central management component for Arista VeloCloud SD-WAN deployments. It carries a CVSS score of 9.9 under version 3.1 and 9.4 under version 4.0. An authenticated user with the minimum Enterprise Read Only role can escalate privileges to superuser operator status, gaining access to internal functionality that may compromise host confidentiality, integrity, and availability along with managed edge devices and data.

Arista identified the flaw as CWE-89 SQL injection. The company stated that the issue was detected internally and confirmed through evidence of active exploitation. Attacker IP addresses associated with the activity include 74.82.197.86 and 38.54.50.151. This marks the third exploited VeloCloud Orchestrator vulnerability added to the CISA KEV catalog within four months, following CVE-2026-16812 in July and CVE-2026-93952 in September.

Affected versions are limited to on-premises deployments: 5.2.0 through versions prior to 5.2.3.18, 6.1.0 through versions prior to 6.1.3.10, and 6.4.0 through versions prior to 6.4.2.12. VeloCloud Edge and Gateway components remain unaffected. Hosted and Dedicated VCO instances managed by Arista were already updated prior to the public advisory.

Exploitation Timeline, Agency Requirements, and Recommended Actions

Arista published its advisory on October 22, 2026, after observing in-the-wild attacks. CISA incorporated the CVE into the KEV catalog the following day. The catalog entry requires federal civilian executive branch agencies to apply vendor mitigations by October 26, 2026, in accordance with Binding Operational Directive 26-04. Agencies must also conduct forensic triage on potentially impacted systems.

Arista recommends immediate upgrade to the fixed releases 5.2.3.18, 6.1.3.10, or 6.4.2.12 and later. Organizations should restrict access to the web interface, monitor logs for suspicious activity, block the listed attacker IPs, and inspect systems for backdoors or webshells if compromise is suspected. No full workaround exists for on-premises instances that require external exposure for management.

CISA noted that ransomware deployment linked to this specific flaw has not been confirmed. The orchestrator manages SD-WAN policies, configurations, and edge devices for enterprises and managed service providers, making any successful compromise potentially disruptive to wide-area network operations.

Market Context and Ongoing Vendor Response

Arista VeloCloud Orchestrator on-premises deployments have faced repeated security issues throughout 2026. Each prior flaw also reached the CISA KEV catalog after evidence of exploitation emerged. The pattern underscores the exposure risk for organizations that maintain self-hosted SD-WAN controllers without network segmentation or strict access controls.

Users of affected versions are advised to review authentication logs, verify patch status across all instances, and implement network-level restrictions where upgrades cannot be completed immediately. No public proof-of-concept exploit code has been released, and no specific threat actor attribution has been confirmed by either Arista or CISA.