CISA Adds Actively Exploited Arista VeloCloud Orchestrator SQL Injection Flaw to KEV Catalog
Summary
CISA added CVE-2026-114625, an Arista VeloCloud Orchestrator SQL injection flaw, to its KEV Catalog based on evidence of active exploitation and urged organizations to prioritize remediation.
Key points
- CISA added CVE-2026-114625, an Arista VeloCloud Orchestrator SQL injection vulnerability, to the KEV Catalog.
- CISA cited evidence of active exploitation but provided no further exploitation details in the article.
- CISA urges organizations to prioritize remediation of KEV-listed vulnerabilities using risk-based vulnerability management.
- BOD 26-04 requires FCEB agencies to prioritize certain high-risk KEV vulnerabilities on publicly exposed assets and sets expectations for checking possible compromise before patching.
Article Details
- Vulnerability Types
- SQL injection
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown