A SQL injection flaw in Arista VeloCloud Orchestrator is now on the federal government’s most urgent list, and federal agencies have until Monday, October 26, to patch it. CISA added the bug, tracked as CVE-2026-114625, to its Known Exploited Vulnerabilities (KEV) catalog on Friday, October 23, 2026. SecurityWeek describes it as a critical-severity flaw that gives attackers access to privileged internal functions and operator privileges.

SecurityWeek also reported that attackers are exploiting a third Arista VeloCloud Orchestrator, or VCO, zero-day in about four months. That repetition may matter more than any single CVE, because it suggests one product is drawing sustained attention from attackers. Here is what the KEV listing means, what the deadline requires, and where the reporting still has gaps.

Arista VeloCloud Orchestrator zero-day: what CISA added

CISA’s October 23 alert says the agency added one vulnerability to the KEV catalog based on evidence of active exploitation. It identifies that entry as CVE-2026-114625, an Arista VeloCloud Orchestrator SQL injection flaw.

The alert also explains why this class of bug draws attention. It says the type of flaw is “a frequent attack vector for malicious cyber actors” and that such flaws pose “significant risks to the federal enterprise.” Those are agency statements about the category of bug, not findings about this particular exploit campaign.

KEV is the list CISA keeps for vulnerabilities with confirmed exploitation in the wild. Federal civilian agencies must patch what appears on it by a set deadline. For everyone else, a KEV listing is the clearest public signal that a bug is being used in real attacks, not just demonstrated in research.

VeloCloud Orchestrator is used to manage VeloCloud SD-WAN deployments. That puts the risk on enterprises and service operators that run the orchestrator, rather than on consumers directly. Consumers feel the effects only when the services that depend on those networks are disrupted or exposed.

CISA KEV October 2026: the October 26 deadline

The Hacker News reported that federal agencies were directed to patch by October 26. That leaves roughly three days from the October 23 listing, and the deadline arrives tomorrow. USA 24 could not see the date in the text of CISA’s alert, so agencies should confirm the due date in the KEV entry itself rather than rely on a secondary report.

Nothing in the reporting says whether CISA will extend the deadline. USA 24 also could not retrieve Arista’s advisory, which means anyone who has to verify affected versions first has less time to work with.

Any federal contractor or agency that runs VeloCloud Orchestrator should treat the listing as urgent. Managed service providers face the harder version of the problem. If a provider runs the orchestrator for many customers, one fix can require coordinating many change windows, and some customers may not be reachable before the deadline.

Agencies that cannot apply a fix in time will need a documented risk decision and a plan to isolate the orchestrator until they can patch.

A third Arista zero-day in four months

SecurityWeek’s framing is the strongest angle in this story. Three zero-days in about four months suggest the orchestrator has become a repeat target, not a one-off exposure. For defenders, that changes the question from “did we patch this bug” to “how quickly can we patch the next one.”

The reporting does not establish whether the three bugs are linked to the same threat actor. Nothing in the sources reviewed for this story ties them to a common group or campaign, so readers should treat the pattern as a warning about attention and exposure rather than proof of coordinated activity.

Repeat exposure in management and edge software is not unique to Arista. The Hacker News has reported on earlier 2026 flaws in SharePoint and MikroTik RouterOS that were actively exploited in the wild. USA 24 has also covered edge and gateway exposure in its reporting on PHP2Shell flaws that spread into Palo Alto PAN-OS and Okta gateway advisories. Taken together, these stories argue for keeping an accurate inventory of management systems, since that inventory determines how fast a fix can reach the right devices.

Arista VeloCloud patch steps for admins

Start with inventory, then move to the fix. The steps below follow standard practice for an actively exploited flaw, and the vendor advisory should override them where the two differ.

  • Check whether any site, branch or managed customer runs VeloCloud Orchestrator, and record the exact version of each instance.
  • Read Arista’s advisory for the affected versions and the fixed release. USA 24 could not retrieve that advisory for this story, so do not rely on version numbers from secondary coverage.
  • Apply the vendor fix before October 26. If that is not possible, document the risk decision and restrict who can reach the orchestrator’s management interface.
  • Review orchestrator logs for SQL injection indicators, using the indicators Arista publishes in its advisory.
  • If you find signs of exploitation, rotate the operator and API credentials tied to the orchestrator and treat the system as potentially compromised.

Most individual consumers cannot patch this themselves. If a service you use runs on a network managed through VeloCloud, the question to ask the provider is whether it has applied the fix.

Where the reporting still conflicts

CISA’s alert lists one vulnerability added on October 23. The Hacker News reports that CISA added two flaws that Friday, one in Collabora Online Built-in CODE Server and one in Arista VeloCloud Orchestrator. USA 24 could not confirm from CISA’s alert that the Collabora flaw was a separate KEV entry added the same day, so check the KEV catalog directly before citing a count.

Several other details remain unconfirmed. The affected versions, the vendor’s own statement on exploitation, the number of affected customers and whether any breach or data theft has occurred are not established in the sources reviewed. Until Arista publishes its advisory, the scope of this flaw is an open question.

What to watch next

Three things will settle over the coming days. The first is whether CISA holds the October 26 deadline or extends it. The second is whether Arista publishes an advisory that names affected versions and a fixed release, which would let operators move from triage to remediation. The third is whether CISA’s own records resolve the one-versus-two discrepancy for October 23.

Attribution is the next question to watch. If investigators tie the three Arista zero-days to one threat actor, defenders would need monitoring focused on that group’s methods rather than on opportunistic scanning. If a fourth zero-day appears in the same product, the story will likely shift from individual advisories to a broader question about how quickly the vendor and its customers close these gaps.