VeloCloud Orchestrator CVE-2026-114625

Requires an existing authenticated account of any privilege level on an on-prem VeloCloud Orchestrator (CVSS PR:L; description: 'any authenticated user can gain operator privileges'). The escalation is achieved via SQL injection (CWE-89) and yields masquerade as a local 'superuser operator', exposing functionality intended only for internal use. Limiting factors: the attacker must first obtain valid credentials/session (not anonymous), and the exploitable target is the on-prem deployment - hosted and Dedicated instances are reported already patched by the vendor. No user interaction is required (UI:N) and attack complexity is low (AC:L). The exact injectable parameter or endpoint is not described in the available sources.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low privileges - i.e. any valid authenticated account - with full high impact to confidentiality, integrity and availability on both the vulnerable and subsequent systems (VC/VI/VA:H and SC/SI/SA:H), consistent with the description's claim that a normal authenticated user can escalate to a 'superuser operator' and impact the VCO host. The vuln.today decision label is act_now, reinforcing urgency. CWE-89 and the SQLi tag indicate the escalation vector is SQL injection, though the Arista advisory text supplied here does not spell out the exact injectable parameter. Signal gaps to note explicitly: no EPSS score is provided, so exploitation probability cannot be quantified; the CVE is not listed in CISA KEV in the supplied data; and no public exploit or PoC reference is present (only the vendor advisory). The barrier to exploitation is authentication (PR:L), which limits purely anonymous internet-wide exploitation but is low for any environment with multiple operator/customer accounts. One scoping nuance: the description states hosted and Dedicated instances are already patched, while the affected CPE is the on-prem VeloCloud Orchestrator - so remediation action centers on customer-managed on-prem deployments.

An attacker who holds any low-privilege authenticated account on an on-prem VeloCloud Orchestrator submits crafted input that triggers SQL injection (CWE-89), elevating their session to a 'superuser operator' and unlocking internal-only functionality not meant to be remotely reachable. From there they read and tamper with orchestrator-managed SD-WAN data and configuration and can affect the VCO host itself. No public exploit code is identified in the available data; the attack requires existing authenticated access but low complexity and no user interaction.