CISA adds exploited Arista VeloCloud Orchestrator SQL injection to KEV
Original title: CISA Adds One Known Exploited Vulnerability to Catalog
CVE-2026-114625 is listed on evidence of active exploitation; FCEB agencies must prioritize remediation under BOD 26-04.
CISA added CVE-2026-114625, an Arista VeloCloud Orchestrator SQL injection vulnerability, to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV entries on publicly exposed assets that grant total control after exploitation, and to check whether systems were compromised before patching. CISA encourages other organizations to remediate KEV vulnerabilities on a risk basis. No fixed version or attack details are stated.
- The added entry is CVE-2026-114625, an Arista VeloCloud Orchestrator SQL injection.
- BOD 26-04 applies to FCEB agencies, not private organizations.
- CISA says additions need a CVE ID, exploitation evidence, and mitigation guidance.
Impact: SQL injection on Arista VeloCloud Orchestrator under active exploitation
| Product | Affected |
|---|---|
| Arista VeloCloud Orchestrator | — |
- 1.Prioritize remediation of CVE-2026-114625 on publicly exposed VeloCloud Orchestrator assets.
- 2.Check whether the system was compromised before the patch was applied.
- CVEs
- CVE-2026-114625
- Vendors
- Arista
- Products
- VeloCloud Orchestrator
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114625 | SQL injection in Arista VeloCloud Orchestrator grants superuser | 9.4 | 1% | KEV | KEV |
From the original article
1 min read at cisa.govCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.