Arista VeloCloud Orchestrator SQL Injection Under Active Attack

Active Exploitation Confirmed

CISA added CVE-2026-114625, an SQL injection vulnerability in Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities catalog on October 23, 2026. The addition signals that attackers are actively exploiting this flaw in the wild. SQL injection vulnerabilities allow attackers to manipulate database queries, potentially granting complete control over affected systems. Federal agencies must remediate this vulnerability on publicly exposed assets under BOD 26-04, and CISA recommends all organizations follow suit.

What This Means for SMBs

If your organization uses Arista VeloCloud for SD-WAN orchestration, this vulnerability poses an immediate risk. Successful exploitation can give attackers total control of the orchestrator, compromising network visibility, configuration, and potentially providing a foothold for ransomware deployment or data exfiltration. Check your VeloCloud Orchestrator version immediately and apply vendor patches without delay. Organizations should also review logs for signs of compromise before patching, as attackers may have already established persistence. This is a reminder that SD-WAN and cloud infrastructure components require the same vigilant patch management as traditional on-premises systems.

Read the full CISA alert

Need Help Securing Your Infrastructure?

O-Cyrus helps SMBs prioritize and remediate critical vulnerabilities before they become breaches. Our security services include vulnerability management, infrastructure hardening, and incident response planning. Contact us to discuss how we can strengthen your security posture.