The United States Cybersecurity and Infrastructure Security Agency has flagged a critical flaw in Arista VeloCloud Orchestrator as actively exploited, adding it to its Known Exploited Vulnerabilities catalogue. The flaw, tracked as CVE-2026-114625, is a SQL injection vulnerability in the on-premises version of the orchestration platform, which is used to manage wide-area networks.

What the flaw allows

According to security summaries of the CISA listing, a remote attacker with network access and an authenticated session, even with minimal privileges, may be able to access privileged functionality through the injection flaw. That combination is serious for network management tools, because they sit at the centre of an organisation's connectivity. Exploitation has been reported multiple times since July 2026, according to the same summaries, which points to a persistent rather than one-off threat.

What organisations should do

The standard response is to apply the vendor patch promptly, restrict access to the vulnerable interfaces so they are not exposed more widely than necessary, and monitor traffic for suspicious activity. Organisations should also enforce strong authentication and network segmentation, so that a flaw in one system does not easily become access to everything else. Federal agencies face binding remediation deadlines under CISA's directive; other organisations should treat the listing as a strong urgency signal.

Part of a wider wave

The Arista listing arrived alongside a CISA warning about a critical Collabora Online flaw, CVE-2026-110447, which the Daily Byte covered earlier. Together they underline a busy patching week for administrators. Check the vendor advisory for the exact fixed version before acting, and verify the patch after installation. Sources: CISA Known Exploited Vulnerabilities catalogue as reported by The Hacker News; BestSec digest.