Critical SQL Injection (CVE‑2026‑114625) in Arista VeloCloud Orchestrator Threatens Management Plane
What It Is — Arista VeloCloud Orchestrator on‑prem contains an unauthenticated SQL injection that can be leveraged to execute arbitrary queries against the orchestrator’s database, potentially granting privileged access to internal functions.
Exploitability — Publicly disclosed; proof‑of‑concept code is available; CVSS (when published) rates it high.
Affected Products — Arista VeloCloud Orchestrator (on‑premises deployments).
Why It Matters for Trust & Control Assurance
- Highlights the necessity of continuous validation of input‑validation and secure‑configuration controls across the SD‑WAN management stack.
- A successful exploit compromises confidentiality, integrity, and availability, breaking the evidentiary chain auditors expect for data‑handling controls.
- Remediating the flaw and evidencing the fix feeds directly into a single control objective—secure configuration and input validation—that maps to many frameworks (e.g., NIST CSF, ISO 27001).
Recommended Actions
- Apply Arista’s security patch for CVE‑2026‑114625 immediately.
- Conduct a control‑mapping review to confirm that input‑validation and privileged‑access controls are documented, enforced, and audit‑ready.
- Integrate the patch status into your continuous‑monitoring platform to provide real‑time, defensible evidence for auditors.
Source: CISA KEV – CVE‑2026‑114625