CISA has added a new vulnerability, CVE-2026-114625, a SQL injection flaw in Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities Catalog. This addition is due to evidence of active exploitation, which poses significant risks. This type of vulnerability is a common attack method for malicious actors. Federal agencies are required to prioritize fixing vulnerabilities listed in the KEV Catalog, especially on publicly exposed systems. This prioritization is mandated by Binding Operational Directive 26-04 to manage risks effectively. The directive also outlines requirements for agencies to check for system compromises before patching. While BOD 26-04 is specific to Federal Civilian Executive Branch agencies, CISA urges all organizations to adopt similar risk-based vulnerability management. CISA will continue adding vulnerabilities to the KEV Catalog as they meet the criteria. Organizations can nominate vulnerabilities they are aware of that are being exploited but not yet listed. Nominations require a CVE ID, proof of exploitation, and clear mitigation steps.