Wire · regulatory
U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog
◆ Sectors
◆ Geography
◆ Source
◆ Verified
Fusion42 · 24 October 2026 · Fusion42 review
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SQL injection flaw in Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch it by October 26, 2026. The vulnerability allows authenticated users, even with minimal permissions, to gain operator privileges and potentially compromise the system and managed data.
This Wire brief sits within Fusion42's coverage of Enterprise, and 2 sources have reported it.
◆ ◆ The Wire takeaway
You must prioritise patching VeloCloud Orchestrator now because CISA has set a hard federal deadline that signals rising scrutiny on SD-WAN security. Failure to act immediately exposes you to confirmed risks that federal agencies are required to fix, opening you to government contract risks and cyber attacks.
◆ Coverage
2 sources · 24 Oct 2026
◆ Related on Wire
◆ Topics