Security teams managing network infrastructure face a significant risk following the disclosure of a critical security flaw in on-premises deployments. Arista has addressed a high-severity vulnerability that impacts the VeloCloud Orchestrator, which demands prompt attention from administrators and IT security personnel.
Tracked as CVE-2026-114625, this issue involves a SQL injection vulnerability within the orchestrator. Notably, this flaw is currently included on CISA's Known Exploited Vulnerabilities list, indicating that active exploitation has been observed in the wild.
What Happened
The vulnerability exists in the on-premises version of Arista VeloCloud Orchestrator. According to available details:
- It is a SQL injection flaw that may allow a remote attacker to access privileged internal functionality.
- Successful exploitation can directly impact the underlying VCO host.
- The issue poses a comprehensive threat to the confidentiality, integrity, and availability of the orchestrator itself.
- Data managed directly by the orchestrator may also be compromised during an attack.
Who Should Care
Organizations and small businesses utilizing on-premises instances of Arista VeloCloud Orchestrator should prioritize this alert immediately. Because this orchestrator typically manages critical network topologies and sensitive routing data, an administrative-level compromise of the host can ripple across your entire infrastructure.
Even if your business does not operate the orchestrator directly, supply chain partners or managed service providers who rely on vulnerable setups could expose interconnected systems to secondary risk.
What to Do Now
Security incidents involving infrastructure management tools require swift, methodical responses to maintain operational integrity:
- Verify Your Inventory: Confirm whether your organization utilizes on-premises Arista VeloCloud Orchestrator instances.
- Review Vendor Guidance: Consult official advisory channels from Arista to identify recommended updates or mitigation steps specific to your deployment.
- Monitor Access: Inspect network logs and access controls around your orchestrator endpoints for any unusual or unauthorized administrative activity.
Proactive vulnerability management helps ensure your external-facing assets and internal infrastructure remain secure against evolving threats.
Ready to check your public-facing web applications and infrastructure for vulnerabilities? Run a free security check today.