CISA adds Arista VeloCloud flaw to KEV
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
CISA added an actively exploited SQL injection vulnerability in Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog.
CISA has added CVE-2026-114625, a SQL injection vulnerability affecting Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation. SQL injection vulnerabilities remain a common and effective attack vector for threat actors, often enabling unauthorized data access, authentication bypass, or further system compromise.
Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities on publicly exposed assets on a prioritized, risk-based timeline, particularly those that grant total control of an asset post-exploitation. The directive also requires agencies to determine whether systems were compromised prior to patching. While BOD 26-04 is binding only on FCEB agencies, CISA recommends that all organizations using Arista VeloCloud Orchestrator treat this as a high-priority patching item and review for signs of prior compromise given the confirmed in-the-wild exploitation.
Defenders running Arista VeloCloud Orchestrator should identify affected versions, apply vendor-supplied patches or mitigations as soon as available, and audit logs for indicators of SQL injection attempts or unauthorized database access predating remediation.
Mentioned in this report
Detection guidance
SQL Injection Patterns in Web Request Query String
Detects common SQL injection payload keywords (UNION SELECT, time-based sleeps, information_schema, error-based functions) in web server request query strings, as used against public-facing apps such as management orchestrators. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Patterns in Web Request Query String
description: Detects typical SQL injection payload constructs in the query string
of requests to a public-facing web application (for example an orchestrator management
portal). Generic SQLi behaviour, not tied to a specific endpoint. Applications that
pass parameters in JSON POST bodies will not be covered by query-string logging.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- union select
- union+select
- union%20select
- union all select
- union+all+select
- union%20all%20select
- information_schema
- pg_sleep(
- pg_sleep%28
- waitfor delay
- waitfor+delay
- waitfor%20delay
- extractvalue(
- updatexml(
condition: selection
falsepositives:
- Authorised web application vulnerability scanners run against the orchestrator
- Applications that legitimately pass SQL-like text in query parameters, for example
documentation or search pages
level: medium
id: e4f466c7-7e2a-5aab-87a5-5227d6038e82
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
SQLMap User-Agent Against Web Application
Detects the sqlmap automated SQL injection tool user-agent in web server logs, indicating automated SQLi exploitation attempts against a public-facing app. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQLMap User-Agent Against Web Application
description: Detects requests whose user-agent identifies sqlmap, an automated SQL
injection exploitation tool, against a public-facing web application. Attackers
often change the user-agent, so absence of a hit does not rule out SQLi.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-user-agent|contains: sqlmap
condition: selection
falsepositives:
- Authorised penetration tests or internal security scanning using sqlmap
level: high
id: c2f5854b-0753-5fa9-afbd-7941dafb2a6c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,083 reports from 142 sources, 541 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs