Arista VeloCloud Orchestrator SQL Injection (CVE‑2026‑114625) Added to CISA KEV Catalog
What It Is – CISA announced that the SQL‑injection flaw in Arista VeloCloud Orchestrator (CVE‑2026‑114625) is now listed in the Known Exploited Vulnerabilities (KEV) catalog. The vulnerability allows an unauthenticated attacker to inject arbitrary SQL commands, potentially gaining full control of the orchestrator backend.
Exploitability – Evidence of active exploitation in the wild; the CVSS score is publicly disclosed as 9.8 (critical).
Affected Products – Arista VeloCloud Orchestrator (SD‑WAN management platform) – all versions prior to the vendor‑released patch.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a vulnerability‑management control that continuously inventories, scores, and patches high‑risk flaws.
- Provides a concrete audit artifact (KEV listing) that can be referenced in compliance evidence packs.
- Highlights how rapid remediation, documented in a trusted system, satisfies multiple framework requirements (e.g., NIST CSF Identify and Protect functions).
Recommended Actions
- Verify whether any of your assets run an unpatched version of VeloCloud Orchestrator.
- Prioritize patching this CVE in accordance with BOD 26‑04 and capture remediation tickets as evidence.
- Map the remediation activity to the “Vulnerability Management” control objective in your control framework and record the evidence in your Trust Center.
- Update your asset inventory and risk‑scoring models to reflect the new KEV entry.
Source: CISA Advisory – 23 Oct 2026