# Arista VeloCloud Orchestrator Flaw Added to CISA KEV, Patch Due Oct. 26

- URL: https://usa-24.com/arista-velocloud-orchestrator-zero-day/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-25T21:37:57.756Z
- Updated: 2026-10-25T21:37:57.760Z
- Topics: Cybersecurity, Zero-Day Exploits, CISA, Arista Networks, Patch Management, SD-WAN

> CISA added the actively exploited Arista VeloCloud Orchestrator SQL injection flaw to its KEV catalog on October 23. It is the third Arista VCO zero-day in about four months.

## Key takeaways

- CISA added CVE-2026-114625, an Arista VeloCloud Orchestrator SQL injection flaw, to its KEV catalog on Friday, October 23, 2026.
- The Hacker News reports that federal agencies were directed to patch the flaw by October 26, 2026.
- SecurityWeek reports that this is the third Arista VCO zero-day exploited in about four months.
- USA 24 could not retrieve Arista’s advisory, so the affected versions and the fixed release remain unconfirmed.
- CISA’s alert lists one addition for October 23, while The Hacker News reports two, a conflict that is still unresolved.

A SQL injection flaw in Arista VeloCloud Orchestrator is now on the federal government’s most urgent list, and federal agencies have until Monday, October 26, to patch it. CISA added the bug, tracked as CVE-2026-114625, to its Known Exploited Vulnerabilities (KEV) catalog on Friday, October 23, 2026. [SecurityWeek](https://www.securityweek.com/) describes it as a critical-severity flaw that gives attackers access to privileged internal functions and operator privileges.

SecurityWeek also reported that attackers are exploiting a third Arista VeloCloud Orchestrator, or VCO, zero-day in about four months. That repetition may matter more than any single CVE, because it suggests one product is drawing sustained attention from attackers. Here is what the KEV listing means, what the deadline requires, and where the reporting still has gaps.

## Arista VeloCloud Orchestrator zero-day: what CISA added

[CISA’s October 23 alert](https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog) says the agency added one vulnerability to the KEV catalog based on evidence of active exploitation. It identifies that entry as CVE-2026-114625, an Arista VeloCloud Orchestrator SQL injection flaw.

The alert also explains why this class of bug draws attention. It says the type of flaw is “a frequent attack vector for malicious cyber actors” and that such flaws pose “significant risks to the federal enterprise.” Those are agency statements about the category of bug, not findings about this particular exploit campaign.

KEV is the list CISA keeps for vulnerabilities with confirmed exploitation in the wild. Federal civilian agencies must patch what appears on it by a set deadline. For everyone else, a KEV listing is the clearest public signal that a bug is being used in real attacks, not just demonstrated in research.

VeloCloud Orchestrator is used to manage VeloCloud SD-WAN deployments. That puts the risk on enterprises and service operators that run the orchestrator, rather than on consumers directly. Consumers feel the effects only when the services that depend on those networks are disrupted or exposed.

## CISA KEV October 2026: the October 26 deadline

[The Hacker News](https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html) reported that federal agencies were directed to patch by October 26. That leaves roughly three days from the October 23 listing, and the deadline arrives tomorrow. USA 24 could not see the date in the text of CISA’s alert, so agencies should confirm the due date in the KEV entry itself rather than rely on a secondary report.

Nothing in the reporting says whether CISA will extend the deadline. USA 24 also could not retrieve Arista’s advisory, which means anyone who has to verify affected versions first has less time to work with.

Any federal contractor or agency that runs VeloCloud Orchestrator should treat the listing as urgent. Managed service providers face the harder version of the problem. If a provider runs the orchestrator for many customers, one fix can require coordinating many change windows, and some customers may not be reachable before the deadline.

Agencies that cannot apply a fix in time will need a documented risk decision and a plan to isolate the orchestrator until they can patch.

## A third Arista zero-day in four months

SecurityWeek’s framing is the strongest angle in this story. Three zero-days in about four months suggest the orchestrator has become a repeat target, not a one-off exposure. For defenders, that changes the question from “did we patch this bug” to “how quickly can we patch the next one.”

The reporting does not establish whether the three bugs are linked to the same threat actor. Nothing in the sources reviewed for this story ties them to a common group or campaign, so readers should treat the pattern as a warning about attention and exposure rather than proof of coordinated activity.

Repeat exposure in management and edge software is not unique to Arista. The Hacker News has reported on earlier 2026 flaws in [SharePoint and MikroTik RouterOS](https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html) that were actively exploited in the wild. USA 24 has also covered edge and gateway exposure in its reporting on [PHP2Shell flaws that spread into Palo Alto PAN-OS and Okta gateway advisories](https://usa-24.com/php2shell-vulnerability-patch-okta-palo-alto/). Taken together, these stories argue for keeping an accurate inventory of management systems, since that inventory determines how fast a fix can reach the right devices.

## Arista VeloCloud patch steps for admins

Start with inventory, then move to the fix. The steps below follow standard practice for an actively exploited flaw, and the vendor advisory should override them where the two differ.

- Check whether any site, branch or managed customer runs VeloCloud Orchestrator, and record the exact version of each instance.
- Read Arista’s advisory for the affected versions and the fixed release. USA 24 could not retrieve that advisory for this story, so do not rely on version numbers from secondary coverage.
- Apply the vendor fix before October 26. If that is not possible, document the risk decision and restrict who can reach the orchestrator’s management interface.
- Review orchestrator logs for SQL injection indicators, using the indicators Arista publishes in its advisory.
- If you find signs of exploitation, rotate the operator and API credentials tied to the orchestrator and treat the system as potentially compromised.

Most individual consumers cannot patch this themselves. If a service you use runs on a network managed through VeloCloud, the question to ask the provider is whether it has applied the fix.

## Where the reporting still conflicts

CISA’s alert lists one vulnerability added on October 23. The Hacker News reports that CISA added two flaws that Friday, one in Collabora Online Built-in CODE Server and one in Arista VeloCloud Orchestrator. USA 24 could not confirm from CISA’s alert that the Collabora flaw was a separate KEV entry added the same day, so check the KEV catalog directly before citing a count.

Several other details remain unconfirmed. The affected versions, the vendor’s own statement on exploitation, the number of affected customers and whether any breach or data theft has occurred are not established in the sources reviewed. Until Arista publishes its advisory, the scope of this flaw is an open question.

## What to watch next

Three things will settle over the coming days. The first is whether CISA holds the October 26 deadline or extends it. The second is whether Arista publishes an advisory that names affected versions and a fixed release, which would let operators move from triage to remediation. The third is whether CISA’s own records resolve the one-versus-two discrepancy for October 23.

Attribution is the next question to watch. If investigators tie the three Arista zero-days to one threat actor, defenders would need monitoring focused on that group’s methods rather than on opportunistic scanning. If a fourth zero-day appears in the same product, the story will likely shift from individual advisories to a broader question about how quickly the vendor and its customers close these gaps.

## Frequently asked questions

### What is CVE-2026-114625?

CVE-2026-114625 is a SQL injection flaw in Arista VeloCloud Orchestrator that CISA added to its Known Exploited Vulnerabilities catalog on October 23, 2026. CISA added it based on evidence of active exploitation. SecurityWeek describes it as critical severity and says it gives attackers access to privileged internal functions and operator privileges.

### When is the federal patch deadline for the Arista VeloCloud flaw?

The Hacker News reports that federal agencies were directed to patch by October 26, 2026. USA 24 could not see that date in the text of CISA’s alert, so agencies should confirm it in the KEV entry. Whether the deadline will be extended is not yet known.

### Does the Arista VeloCloud Orchestrator flaw affect ordinary consumers?

Consumers are affected only indirectly, through services that run on networks managed with VeloCloud Orchestrator. The direct risk falls on enterprises, managed service providers and federal agencies that operate the product. If a service you rely on runs on such a network, ask the provider whether it has applied the fix.

### What should I do if my organization runs VeloCloud Orchestrator?

Confirm your installed version against Arista’s advisory, apply the vendor fix, and review orchestrator logs for SQL injection indicators. USA 24 could not retrieve Arista’s advisory for this story, so the affected versions and fixed release are unconfirmed here. If you find signs of exploitation, rotate the credentials tied to the orchestrator.

## Sources

1. [Cybersecurity News, Insights and Analysis](https://www.securityweek.com/)
2. [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog)
3. [CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud](https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html)
4. [SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild](https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html)