Arista VeloCloud Orchestrator SQL Injection Vulnerability Added to CISA KEV
CISA KEV · 3 sources
What's on the official record
CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities Catalog on 23 October 2026 (catalog version 2026.10.23). The record describes a SQL injection vulnerability (CWE-89) in the on-premises Arista VeloCloud Orchestrator that may allow a remote attacker to access privileged internal functionality and impact the VCO host. CISA's remediation due date for federal civilian agencies is 26 October 2026. The CVE record names the fixed versions as Arista VeloCloud Orchestrator 5.2.3.18 and 6.1.3.10, with earlier versions affected. The catalog does not record known ransomware use.
Assessment
For a platform or AI-stack owner, the record lets you check whether any on-premises Arista VeloCloud Orchestrator deployment in your estate runs a version earlier than 5.2.3.18 or 6.1.3.10, and to patch or isolate those instances before the 26 October 2026 federal due date. CISA's ADP marks exploitation as active and impact as total, so the record supports treating an unpatched orchestrator as a priority remediation rather than a routine update.
For a cyber underwriter, the record lets you check whether a policyholder's estate includes an on-premises Arista VeloCloud Orchestrator and, if so, whether it is at or above the fixed versions 5.2.3.18 or 6.1.3.10. The record's active-exploitation and total-impact markings support pricing or conditioning coverage on confirmation that the orchestrator has been patched or isolated.
What would change this call
A vendor advisory or CISA update naming additional affected versions or a change in the exploitation status would change the remediation and underwriting checks above.
What to check next
| Check | Why |
|---|---|
| Confirm Arista VeloCloud Orchestrator version against 5.2.3.18 and 6.1.3.10 | Versions earlier than these are affected per the CVE record |
| Watch for a CISA update to the KEV entry | Exploitation status or affected-version scope may change |
Confidence
Filed 25 October 2026 from the record dated 23 October 2026.
Sources
[1] Arista VeloCloud Orchestrator SQL Injection Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-114625
[2] CVE record CVE-2026-114625 — https://www.cve.org/CVERecord?id=CVE-2026-114625
[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog