CVE-2026-114625
SQL Injection in Arista VeloCloud Orchestrator. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 23 October 2026.
- Product
- Arista VeloCloud Orchestrator
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
More from Arista this year.
- CVE-2026-93952 Improper Input Validation, added
- CVE-2026-16812 On-Prem OS Command Injection, added
- CVE-2026-7473 Incomplete Comparison with Missing Factors, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.