CISA: Arista VeloCloud Orchestrator SQLi Under Active Attack

CISA confirmed on October 23 that a SQL injection vulnerability in on-prem Arista VeloCloud Orchestrator is being exploited in the wild, adding CVE-2026-114625 to its Known Exploited Vulnerabilities Catalog and giving Federal Civilian Executive Branch agencies until October 26 to remediate. Three days. That is a fast clock even by recent KEV standards, and it is aimed at a box that sits at the centre of an SD-WAN deployment: the management plane that talks to every branch.

The flaw is as old as the web itself. A remote attacker can inject SQL into the orchestrator and, per CISA's description, reach privileged internal functionality and affect the VCO host. Successful exploitation threatens the confidentiality, integrity and availability of the orchestrator and the data it manages. No exotic exploit chain, no zero-click wizardry — a SQL injection, the kind of bug we've been retiring since before some of your analysts were born.

The timeline as we know it

I write timelines for a living, so let me be honest about this one: it has more gaps than entries. Here is what is on the record.

1. Date unknown — Day 0. Attackers begin exploiting the SQL injection in VeloCloud Orchestrator on-premises deployments. When this started, who is behind it, and against whom it was first used: none of that is in the public record. CISA's listing confirms exploitation happened; it does not date it.
2. October 23 — CISA adds CVE-2026-114625 to the KEV Catalog. The addition is, by CISA's own criteria, based on evidence of active exploitation. That evidence exists somewhere; it has not been shared publicly.
3. October 26 — Federal remediation deadline. Under Binding Operational Directive 26-04, FCEB agencies must remediate KEV-listed vulnerabilities of this class on the compressed schedule. That leaves a weekend for most patching teams.

Everything else — the initial discovery, the victim count, the dwell time before detection — is currently a blank page. When a KEV entry lands with this little context, it usually means one of two things: the evidence came from a source that can't be disclosed, or the reporting is still being stitched together. Either way, defenders should not wait for the full story. The KEV listing itself is the story's actionable part.

What a SQL injection buys on an orchestrator

Strip the product names away and look at the position. VeloCloud Orchestrator is the management plane for an SD-WAN estate. It holds configuration, policy and visibility for the edges under its control. CISA's description says exploitation "may allow a remote attacker to access privileged internal functionality and impact the VCO host," and warns that the confidentiality, integrity and availability of both the orchestrator and the data it manages are at stake.

Translate that into an attack chain. Initial access is the injection itself — remote, against the orchestrator. Privilege is handed over by the bug: privileged internal functionality, no credential theft required. From there, the attacker sits on the host that defines how your branches route, what policies they enforce, and what they trust. Whether real-world intrusions have gone that far — persistence on the host, lateral movement through managed edges, tampering with configurations pushed downstream — is not stated in what CISA has published. But the architecture makes the path available, and that is precisely why management-plane vulnerabilities keep ending up in the KEV.

"CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation." — CISA alert, October 23.

We've watched this pattern before with edge and management infrastructure. When Qilin and Inc ransomware operators chained a PAN-OS authentication bypass for months, the lesson was the same: the device that administers the network is the network, for practical purposes, once an attacker owns it. Nobody called that campaign sophisticated. It was boring, reliable, and it worked. Expect the same economy of effort here.

BOD 26-04 and the hunt-before-you-patch problem

The directive framing this deadline matters. CISA describes BOD 26-04 as requiring agencies to prioritise rapid remediation of KEV vulnerabilities on publicly exposed assets that "grant total control of the asset post-exploitation," while deferring lower-risk work. A bug that hands over privileged internal functionality of the orchestrator fits the total-control description neatly, which explains the three-day fuse.

The more interesting requirement is the second one CISA flags: BOD 26-04 "establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied." That is the part too many organisations skip under deadline pressure. Patching a box that was popped last week doesn't evict anyone. It redecorates the attacker's living room.

So: what did the logs show? On a VCO host, a SQL injection leaves fingerprints — malformed or anomalous database queries in application logs, unexpected queries touching privileged tables, authentication or session events that don't line up with admin activity, and post-exploitation noise if the attacker went further: new processes, outbound connections from a host that should only be talking to its management ecosystem. If your orchestrator's logs aren't being shipped off-box, this is the week you find out why that mattered. A compromised orchestrator is a terrible place to store the evidence of its own compromise.

Who has to move, and how fast

The October 26 deadline legally binds only Federal Civilian Executive Branch agencies. CISA is explicit, though, that it "encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities." In plain terms: if you run on-prem VeloCloud Orchestrator, the federal deadline is a useful forcing function, not a permission slip to wait. The attackers exploiting this flaw are not checking whether their targets fall under a binding operational directive.

Note what is still unknown, because it shapes the response. CISA has not published indicators of compromise, a report on the exploitation campaign, or an attribution. No threat actor has been named, and I won't invent one. Whether Arista has issued a specific patch or mitigation guidance is likewise not covered in the CISA alert itself — check the vendor advisory and the KEV entry's remediation reference directly before you schedule the work. What CISA has told us, and all it needed to tell us, is that the exploitation is real and the clock is short.

The lesson worth keeping

A SQL injection in 2026 is not a sophisticated attack. It is a failure of input handling in a product that should know better, exploited by people who correctly calculated that management planes are soft, trusted and reachable. The defence-side failure is architectural: we keep giving one box the keys to every branch and then acting surprised when the one box becomes the target.

Patch by October 26, whether or not a directive makes you. But before you patch, pull the logs, look backwards through them, and answer the only question that matters after a KEV listing: were they already here? If you can't answer that because the telemetry stayed on the host, fix that too — it's cheaper than the alternative.