Skip to content
securitytabs

LiveUpdated

Arista VeloCloud Orchestrator flaw exploited in attacks, added to CISA's KEV list

A serious flaw in Arista's VeloCloud Orchestrator, the central tool used to manage company network connections, is being exploited by attackers. Organizations running it should check their version and apply Arista's update now.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small firms rarely run this tool themselves, but a managed network provider may manage their sites with it. Arista says the flaw is being exploited. [1]

What to do

  1. Ask your network or IT provider whether VeloCloud Orchestrator is used and whether it has been updated to a fixed version. [1]
  2. Ask the provider to confirm they have followed Arista's advisory. [2]

Mid-size company

A small IT or security team

What to know

Orchestrator versions prior to 5.2.3.18, 6.1.3.10 and 6.4.2.12 are listed as affected, and exploitation is confirmed by Arista. [1]

What to do

  1. Identify any VeloCloud Orchestrator instances and check their versions against the affected list. [1]
  2. Apply the fix described in Arista's Security Advisory 0199. [2]
  3. Treat the flaw as a priority patch, since CISA lists it as exploited. [3]

Large enterprise

A security operations team

What to know

CISA lists the flaw as exploited, and no public indicators of compromise or attribution appear in the sources reviewed. [3][1]

What to do

  1. Inventory all Orchestrator deployments, including those run by managed service providers, and compare versions to the affected list. [1]
  2. Patch per Arista's advisory and review Orchestrator logs and access for signs of abuse, since exploitation is confirmed. [1][3]
  3. Track Arista and CISA for updates, including indicators or attribution. [3]

Vulnerabilities

What happened

CISA added CVE-2026-114625, an SQL injection flaw (a way to send crafted database commands) in Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using. CISA says it acted on evidence of active exploitation and describes this type of flaw as a frequent attack vector. [3]

Security Affairs reports the flaw has a CVSS score of 9.4 and describes VeloCloud Orchestrator as the central management system for the product line. Arista's advisory is titled Security Advisory 0199. [2]

Exploitation

The Canadian Centre for Cyber Security says Arista indicates CVE-2026-114625 is exploited in the wild. The sources reviewed do not say who is behind the attacks, how many organizations are affected, or whether ransomware groups are involved; CISA lists ransomware use as unknown. [1][3]

Affected versions and fixes

The Canadian Centre for Cyber Security lists VeloCloud Orchestrator versions prior to 5.2.3.18, prior to 6.1.3.10 and prior to 6.4.2.12 as affected. Arista's advisory is the authoritative source for fixes. [1]

CISA's KEV listing set a federal due date of October 26, 2026 for federal civilian agencies to address the flaw under its binding directive on prioritizing security updates. [3]

Timeline

  1. Security Affairs reported the KEV listing and the 9.4 severity score. [2]

  2. The Canadian Centre for Cyber Security published an advisory listing affected versions. [1]

  3. CISA added the flaw to its KEV catalogue. [3]

  4. Arista Networks indicated that the flaw was exploited in the wild, as of this date. [1]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Sources

  1. [1]Canadian Centre for Cyber Security · Oct 23, 18:07 UTC
    Arista Networks security advisory (AV26-1080) – Update 1context
  2. [2]Security Affairs · Oct 24, 08:30 UTC
    U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalogcontext
  3. [3]CISA Advisories · Oct 23, 12:00 UTC
    CISA Adds One Known Exploited Vulnerability to Catalogcontext