Arista VeloCloud Orchestrator (on-prem) SQL injection exploited in the wild
Original title：CISA KEV added CVE-2026-114625: Arista VeloCloud Orchestrator – Arista VeloCloud Orchestrator SQL Injection Vulnerability
What happened
On-prem Arista VeloCloud Orchestrator has a SQL injection flaw that CISA lists as exploited in the wild. A remote attacker could reach privileged functions, impact the host, and compromise the orchestrator and its managed data.
Who is affected
- Only firms running on-prem VeloCloud Orchestrator
- Admins of VeloCloud Orchestrator servers
What to do
Check Arista's advisory for affected and fixed versions and update right away. Until then, restrict access to the Orchestrator, keep it off the public internet, and review logs for suspicious activity.
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Arista VeloCloud Orchestrator (on-prem) | 要確認 | 要確認 |
Why this flag
CISA KEV に掲載（悪用確認済み）かつ重大な影響
Red flag: session stopped — Exploitation confirmed with major impact. Assigned only when listed in CISA KEV or confirmed by a primary source.
Sources
- Primary source：CISA Known Exploited Vulnerabilities ↗
- CVE：CVE-2026-114625 ↗