CISA Adds Arista VeloCloud Orchestrator SQL Injection Vulnerability to KEV Catalog
CISA has added CVE-2026-114625, an SQL injection vulnerability in Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added a new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability, identified as CVE-2026-114625, affects the Arista VeloCloud Orchestrator and is characterized as an SQL injection flaw.
This addition to the KEV Catalog signifies that CISA has confirmed evidence of active exploitation of this vulnerability in the wild. SQL injection vulnerabilities are a common and potent attack vector, frequently leveraged by malicious cyber actors to compromise systems and exfiltrate sensitive data. The inclusion of CVE-2026-114625 highlights the significant risk it poses to organizations, particularly within the federal enterprise.
Federal Civilian Executive Branch (FCEB) agencies are mandated by Binding Operational Directive (BOD) 26-04 to prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive specifically requires agencies to focus on publicly exposed assets that, if compromised, could grant attackers total control post-exploitation. The goal is to rapidly address high-risk vulnerabilities while allowing for deferred action on lower-risk ones.
BOD 26-04 also establishes essential requirements for agencies to verify whether systems were compromised before a patch was applied. This proactive measure aims to detect and respond to ongoing or past compromises effectively.
While BOD 26-04's requirements are specific to FCEB agencies, CISA strongly encourages all organizations, regardless of sector, to adopt a risk-based vulnerability management approach. Prioritizing the remediation of vulnerabilities present in the KEV Catalog is a crucial step in enhancing overall cybersecurity posture.
CISA remains committed to continuously updating the KEV Catalog with vulnerabilities that meet the established criteria, ensuring that organizations have access to the most current information on actively exploited threats. The agency also provides a nomination form for the public to submit evidence of exploited vulnerabilities not yet listed in the catalog, provided they have a CVE ID, demonstrable exploitation evidence, and clear mitigation guidance.
The addition of CVE-2026-114625 underscores the ongoing threat landscape and the critical importance of timely patching and robust vulnerability management practices for all organizations.