Summary
- CISA has added CVE-2026-114625 to its Known Exploited Vulnerabilities catalogue, covering a SQL injection flaw in Arista VeloCloud Orchestrator (on-premises deployments).
- Successful exploitation may allow a remote attacker to access privileged internal functionality, with potential impact on confidentiality, integrity, and availability of the orchestrator and the data it manages.
- The remediation deadline under BOD 26-04 is 26 October 2026; organisations must apply vendor mitigations or discontinue use if no mitigations are available.
- Stakeholders are responsible for assessing each affected asset’s internet exposure and aligning patching timelines to BOD 26-04 requirements.
- No corroborating threat intelligence is currently available beyond the CISA advisory; the source material does not confirm active in-the-wild exploitation details.
What Has Been Disclosed
CISA has added CVE-2026-114625 to its Known Exploited Vulnerabilities catalogue. The vulnerability affects Arista VeloCloud Orchestrator in its on-premises form and is classified as a SQL injection flaw. According to the advisory, a remote attacker could exploit it to access privileged internal functionality and affect the VCO host itself.
Scope of Potential Impact
The advisory describes the potential consequences in broad terms: compromise of confidentiality, integrity, and availability — affecting both the orchestrator platform and the data it manages. For organisations that rely on VeloCloud Orchestrator to manage their SD-WAN environments, that scope is significant. The orchestrator sits at the centre of network policy, routing decisions, and visibility across distributed sites. A successful attack against it is not a peripheral incident.
SQL Injection in Network Management Platforms
SQL injection remains one of the most well-understood vulnerability classes, which makes its continued presence in enterprise network management platforms a persistent concern. The flaw here is notable not because the technique is novel, but because of where it sits: a centralised orchestration layer that, if compromised, could expose configuration data, credentials, and network telemetry across an entire SD-WAN deployment. The attack surface is remote and, depending on deployment choices, may be internet-accessible.
Regulatory and Compliance Obligations
For federal agencies and organisations subject to BOD 26-04, the remediation deadline is 26 October 2026. The directive requires organisations to apply mitigations in line with vendor instructions and to follow CISA’s forensics triage requirements. Where mitigations are unavailable, the guidance is direct: discontinue use of the product. Cloud-service variants of VeloCloud Orchestrator are subject to separate BOD 26-04 guidance applicable to cloud services; organisations should confirm which deployment model they are running before determining the correct remediation path.
What Remains Unknown
The CISA advisory does not include attribution, detail on exploitation methods observed in the wild, or specific technical indicators of compromise. No corroborating sources were available at the time of publication. The listing in the KEV catalogue implies that exploitation is considered a real risk, but the source material does not confirm active campaigns or provide further context on the nature of observed exploitation.
Internet Exposure Is a Key Variable
CISA explicitly places the responsibility for exposure assessment on individual stakeholders. Organisations running VeloCloud Orchestrator on-premises should immediately determine whether the management interface is accessible from the internet, and if so, whether compensating controls — such as network access restrictions, VPN requirements, or Web Application Firewall rules — are in place while patching is underway. Reducing the attack surface ahead of full remediation is a straightforward risk reduction step.
Why it matters
VeloCloud Orchestrator is the control plane for SD-WAN environments. A CISO whose organisation runs the on-premises version should treat this as a priority review item: the vulnerability is remote, unauthenticated exploitation is implied by the advisory language, and the impact extends beyond a single host to everything managed by the orchestrator. The BOD 26-04 deadline provides a compliance anchor, but the risk calculus favours acting well before October. CISOs should confirm deployment model, check internet exposure, apply available vendor patches, and — if patches are not yet available — implement compensating controls and escalate to the vendor for timeline clarity.
What to do now
- Identify all on-premises Arista VeloCloud Orchestrator deployments in your environment and confirm version details.
- Assess whether the orchestrator management interface is exposed to the internet and restrict access to trusted networks or VPN where possible.
- Apply mitigations in accordance with Arista vendor instructions as referenced in the CISA advisory.
- If running a cloud-based variant, apply the BOD 26-04 guidance applicable to cloud services rather than the on-premises patching timeline.
- If no mitigations are available from the vendor, follow CISA’s BOD 26-04 guidance on discontinuing use of the product.
- Complete forensic triage per CISA’s published forensics triage requirements and document compliance with BOD 26-04 by the 26 October 2026 deadline.
