Source: cisa.gov
A SQL injection vulnerability has been identified in Arista VeloCloud Orchestrator (VCO) on-premises deployments. The flaw allows a remote attacker to access privileged internal functionality without proper authorization. Successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages. The vulnerability is tracked as CVE-2026-114625 and has been listed by CISA. Arista has published a security advisory with remediation guidance. The issue is subject to CISA's BOD 26-04 directive, which mandates prioritizing security updates based on risk. Organizations running on-prem VeloCloud Orchestrator instances are urged to apply patches immediately. The vulnerability poses significant risk to network management infrastructure given VCO's role in orchestrating SD-WAN environments.
