VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)

Affected Vendors

VMware, Broadcom, Arista

Affected Components

VeloCloud Orchestrator (VCO)

Published Date

2026-10-22

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

On-premise deployments of VeloCloud Orchestrator (VCO).

Impact

Authenticated users can escalate to 'superuser operator' privileges, leading to full system compromise and data breach.

Mitigation

Apply official security patches immediately and restrict network access to the management interface.

Affected Products & Version Scope

All On-premise versions of VeloCloud Orchestrator. (Note: Hosted and Dedicated versions have already been patched by the vendor).

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Immediate Patching: Upgrade to the latest software version provided by the vendor (Broadcom/VMware or Arista) that addresses CVE-2026-114625.
Access Control: Ensure the VCO management interface is not exposed to the public internet. Implement strict ACLs to allow access only from trusted administrative subnets or via a secure VPN.
Monitoring: Enable and review audit logs for any signs of privilege escalation or unauthorized access to internal API endpoints.

bash

# Example: Restricting access to management port (iptables)
iptables -A INPUT -p tcp --dport 443 -s [Admin_IP_Range] -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

On-premise administrators should verify patch levels immediately and restrict management interface exposure until the update is applied.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

This vulnerability is rooted in an SQL Injection (CWE-89) flaw within the VeloCloud Orchestrator (VCO) on-premise software. An authenticated attacker with low-level privileges can exploit this flaw to manipulate backend database queries, effectively bypassing authorization checks. This allows the attacker to masquerade as a local 'superuser operator' and gain unauthorized access to internal-use-only functionalities. With a CVSS score of 9.9 and its inclusion in the CISA KEV catalog, this vulnerability represents a critical risk to SD-WAN infrastructure, as it grants full control over the orchestrator and all managed edge devices.

Official Vendor Advisories & References

NVD Original English Description

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

Source: psirt@arista.com · Mitigation, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: