CISA adds Arista VeloCloud Orchestrator SQL injection flaw to KEV catalog

Federal agencies have until October 26 to fix a SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), after the Cybersecurity and Infrastructure Security Agency added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on October 23. The bug, classed as CWE-89, can let an attacker reach internal functions meant only for privileged operators and affect the VCO host. CISA lists ransomware use as Unknown.

Who can exploit it. An attacker needs network access to the VCO web interface and an authenticated session. Enterprise Read Only, the lowest built-in tenant role, is enough. Arista says no configuration setting prevents the exposure.

Severity. Arista (CNA, advisory 0199) rates it CVSS 3.1 9.9 Critical and CVSS 4.0 9.4 Critical; NVD has analyzed the record but lists only Arista's CNA scores and has not published its own score.

Affected versions and fixes. Affected releases are 5.2.0 to before 5.2.3.18, 6.1.0 to before 6.1.3.10, and 6.4.0 to before 6.4.2.12. Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12. End-of-support versions have not been assessed.

Deployment. Customer action is needed only for on-prem VCO; Hosted and Dedicated VCO were also affected but Arista has already patched them. Until they upgrade, Arista advises on-prem operators to restrict access to the web interface to trusted networks, watch for unexpected outbound traffic and webshells, and review recent administrator activity.

Background. Arista says it found the flaw itself. Its security advisory 0199 is dated October 22, and the CVE record was published the same day.