CISA adds exploited VeloCloud Orchestrator flaw to KEV, with October 26 federal due date
U.S. civilian federal agencies face an October 26 remediation due date for an exploited vulnerability in on-premises Arista VeloCloud Orchestrator after CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on October 23. Arista says fixed releases are available and that hosted versions, including dedicated deployments, have already been patched.
News date: 2026-10-23 · Checked: 2026-10-24 (Asia/Bangkok)
U.S. civilian federal agencies face an October 26 remediation due date for an exploited vulnerability in on-premises Arista VeloCloud Orchestrator after CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on October 23. Arista says fixed releases are available and that hosted versions, including dedicated deployments, have already been patched.
Three key points
- CVE-2026-114625 affects specified on-premises VeloCloud Orchestrator software releases.
- CISA’s entry lists October 26, 2026 as the due date and requires forensic triage under its federal guidance.
- Arista lists fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12 and later releases within those trains.
Check the software, not just the hardware label
Arista’s October 22 advisory describes an SQL-injection issue that can expose privileged internal functionality and affect the orchestrator and its managed data. Both the vendor and CISA report active exploitation.
The vendor identifies affected 5.2.x, 6.1.x and 6.4.x releases below their respective fixed versions. It says exposure depends on the software release and that unsupported versions were not assessed. The notice does not mean every Arista switch, access point or cloud product is affected.
Federal deadline and wider enterprise response
The binding requirements discussed by CISA apply to Federal Civilian Executive Branch agencies. CISA also encourages other organizations to prioritize known exploited vulnerabilities through risk-based remediation; the federal due date is not presented here as a universal legal deadline for every private company.
The catalog calls for vendor-directed mitigation and forensic triage under the applicable federal guidance. Administrators can use the original advisory to check their deployment and fixed-release train. The archive network-equipment photo accompanying this report is illustrative and does not depict an affected VCO installation.
