CISAAnalysisCISA adds Arista VeloCloud Orchestrator SQL injection flaw to KEV catalog
What happened.CISA added an actively exploited SQL injection flaw in on-premises Arista VeloCloud Orchestrator deployments to its Known Exploited Vulnerabilities catalog.
Why it matters.SD-WAN orchestrators manage wide-area enterprise routing topologies, cryptographic tunnels, and edge policies. A compromised central orchestrator gives adversaries complete visibility into private data paths and branch traffic. Network administrators running self-hosted VeloCloud instances must apply vendor updates immediately and restrict management consoles to isolated administrative subnets.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-114625 with a 9.9 CVSS score, the defect allows an authenticated user with low-privilege web access to execute arbitrary SQL queries.
- Exploitation path: Attackers leverage the input sanitization flaw to elevate privileges to local superuser operator status and assume administrative control over the managed SD-WAN network.
- Remediation releases: Arista delivered updated builds in software versions 5.2.3.18, 6.1.3.10, and 6.4.2.12, requiring federal agencies to remediate affected systems under risk directive timelines.