CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The specific flaw is CVE-2026-114625, an SQL injection vulnerability in Arista VeloCloud Orchestrator. This addition aligns with Binding Operational Directive 26-04, which requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of high-risk vulnerabilities listed in the catalog. The directive emphasizes fixing issues on publicly exposed assets that grant total control post-exploitation. CISA encourages all organizations to adopt this risk-based approach to vulnerability management.
Read the full story at cisa.gov.
Photo: Pexels / Pixabay
