# CISA adds Arista VeloCloud flaw to KEV

Published: 2026-10-23 · Severity: severe · Sectors: Government (National), Technology, Telecommunications
Canonical: https://vorant.io/reports/2c4e5453-dd12-5123-8b06-61fcc60f1486/cisa-adds-arista-velocloud-flaw-to-kev

> CISA added an actively exploited SQL injection vulnerability in Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog.

CISA has added CVE-2026-114625, a SQL injection vulnerability affecting Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation. SQL injection vulnerabilities remain a common and effective attack vector for threat actors, often enabling unauthorized data access, authentication bypass, or further system compromise.

Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities on publicly exposed assets on a prioritized, risk-based timeline, particularly those that grant total control of an asset post-exploitation. The directive also requires agencies to determine whether systems were compromised prior to patching. While BOD 26-04 is binding only on FCEB agencies, CISA recommends that all organizations using Arista VeloCloud Orchestrator treat this as a high-priority patching item and review for signs of prior compromise given the confirmed in-the-wild exploitation.

Defenders running Arista VeloCloud Orchestrator should identify affected versions, apply vendor-supplied patches or mitigations as soon as available, and audit logs for indicators of SQL injection attempts or unauthorized database access predating remediation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-114625 (KEV)

## Detection guidance (public sample)

### SQL Injection Patterns in Web Request Query String

ATT&CK: T1190

Detects common SQL injection payload keywords (UNION SELECT, time-based sleeps, information_schema, error-based functions) in web server request query strings, as used against public-facing apps such as management orchestrators. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Injection Patterns in Web Request Query String
description: Detects typical SQL injection payload constructs in the query string
  of requests to a public-facing web application (for example an orchestrator management
  portal). Generic SQLi behaviour, not tied to a specific endpoint. Applications that
  pass parameters in JSON POST bodies will not be covered by query-string logging.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - union select
    - union+select
    - union%20select
    - union all select
    - union+all+select
    - union%20all%20select
    - information_schema
    - pg_sleep(
    - pg_sleep%28
    - waitfor delay
    - waitfor+delay
    - waitfor%20delay
    - extractvalue(
    - updatexml(
  condition: selection
falsepositives:
- Authorised web application vulnerability scanners run against the orchestrator
- Applications that legitimately pass SQL-like text in query parameters, for example
  documentation or search pages
level: medium
id: e4f466c7-7e2a-5aab-87a5-5227d6038e82
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
```

### SQLMap User-Agent Against Web Application

ATT&CK: T1190

Detects the sqlmap automated SQL injection tool user-agent in web server logs, indicating automated SQLi exploitation attempts against a public-facing app. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQLMap User-Agent Against Web Application
description: Detects requests whose user-agent identifies sqlmap, an automated SQL
  injection exploitation tool, against a public-facing web application. Attackers
  often change the user-agent, so absence of a hit does not rule out SQLi.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-user-agent|contains: sqlmap
  condition: selection
falsepositives:
- Authorised penetration tests or internal security scanning using sqlmap
level: high
id: c2f5854b-0753-5fa9-afbd-7941dafb2a6c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2c4e5453-dd12-5123-8b06-61fcc60f1486/cisa-adds-arista-velocloud-flaw-to-kev.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup