Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator SQL Injection Vulnerability
Info Listed in CISA KEV
Summary
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- Arista:VeloCloud Orchestrator
Sources
- CISA KEV DATABASE
Original Links
- https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 reference
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk reference
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk reference
- https://nvd.nist.gov/vuln/detail/CVE-2026-114625 reference
Timeline
- kev_ingest CISA KEV