Arista has patched CVE-2026-114625, a critical SQL injection flaw in VeloCloud Orchestrator exploited as a zero-day.