External risk intelligence

VeloCloud Orchestrator Privileged Access Escalation Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-114625

The VeloCloud Orchestrator (VCO) is a centralized management platform used to control and monitor network infrastructure. Such systems are typically deployed as edge services or management portals to facilitate the administration of distributed environments, making them common targets for network-based access in many deployment architectures.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in on-premises VeloCloud Orchestrator (VCO) systems, potentially allowing authenticated users to access privileged internal functions and compromise the orchestrator and its data. While hosted versions have been patched, the main concern for on-premises deployments is confirming relevance and exposure.

Authenticated users gain high-level operator privileges.
Matters for on-premises systems' administrative control.
Confirm relevance and exposure for on-premises deployments.

Attack Path

How an attacker could exploit the issue

An authenticated user with limited privileges could potentially gain full administrative control over the VeloCloud Orchestrator (VCO) by accessing internal functionality intended only for superuser operators. This could allow an attacker to compromise the confidentiality, integrity, and availability of the orchestrator and its managed data.

Any authenticated user can access.
Accesses privileged internal functionality.
Compromises orchestrator and data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow any authenticated user to access privileged internal functionality within the VeloCloud Orchestrator (VCO). This access could impact the orchestrator host and compromise its confidentiality, integrity, and availability, as well as the data it manages. The advisory notes that hosted and dedicated versions have been patched.

Orchestrator and managed data are at risk.
Authenticated users could gain elevated access.
Compromise of confidentiality, integrity, availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the VeloCloud Orchestrator (VCO) on-prem necessitates immediate attention from infrastructure and security teams. The first actionable step is to inventory all on-prem VCO instances, determine their network exposure, confirm business criticality, and identify the accountable system owner before planning remediation.

Infrastructure and security teams own remediation.
Verify on-prem VCO instances and exposure.
Plan remediation based on criticality and exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the VeloCloud Orchestrator?

VeloCloud Orchestrator (VCO) is a centralized software platform used by administrators to manage, configure, and monitor SD-WAN network infrastructure. It acts as the control plane for distributed environments, allowing organizations to oversee complex network settings from a single management portal.

What is the weakness class for CVE-2026-114625?

This vulnerability is classified as CWE-89, which typically relates to improper neutralization of special elements used in commands. In the context of this CVE, it describes a flaw where an authenticated user can bypass normal access controls to reach privileged internal functions, effectively granting them unauthorized 'superuser' status within the orchestrator.

Do I need to be an administrator to trigger this bug?

No. The vulnerability does not require prior administrative rights; any user with a standard, authenticated account can initiate the escalation. It is not triggered by unauthenticated users or those without valid login credentials to the system.

How does Halo Surface Signal categorize this threat?

Halo Surface Signal identifies this as 'Likely' to be relevant for many organizations. Because VeloCloud Orchestrator functions as a management portal for distributed networks, it is frequently deployed as an edge service accessible via the network, increasing the likelihood that it is reachable and potentially exposed to remote attackers.

How should I respond to this VeloCloud Orchestrator issue?

Begin by creating an inventory of all on-premises VCO instances. Identify the network exposure and business criticality for each instance, and confirm who is responsible for the system. This information is essential for teams to prioritize and plan their remediation efforts.

References

www.arista.com/en/support/advisories-notices/security-advisory/24838…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.