🔴 EXPLOITED
CVE-2026-114625: Arista VeloCloud Orchestrator on-prem has an SQL injection flaw letting any authenticated user act as a superuser operator. It is listed in CISA KEV.
Affected: 5.2, 6.1 and 6.4 releases before 5.2.3.18, 6.1.3.10 and 6.4.2.12, the fixed versions. CISA's due date was 2026-10-26.