Arista Networks disclosed a critical SQL injection flaw in VeloCloud Orchestrator On-Prem, CVE-2026-114625, scoring CVSS 9.9. CISA added it to the KEV catalog https://deafnews.it/en/article/arista-velocloud-sql-injection-cve-2026-114625-scores-cvss-99-cisa-deadline-october-26
DeafNewsArista VeloCloud: SQL Injection CVE-2026-114625 Scores CVSS 9.9, CISA Deadline October 26 | DeafNewsArista Networks disclosed CVE-2026-114625, a critical SQL injection in VeloCloud Orchestrator On-Prem rated CVSS 9.9. CISA added it to the KEV catalog on October 23, 2026, giving federal agencies a three-day remediation deadline of October 26.