VeloCloud Orchestrator EUVD-2026-49371

Requires valid authenticated access to the VeloCloud Orchestrator On-Prem management API (PR:L) - the attacker must possess working credentials, so anonymous exploitation is not possible. Exploitation targets an input-validation flaw in an API component that manipulates backend SQL queries; no special non-default feature toggle is cited, so any reachable authenticated API session on affected on-prem versions (5.2.0 before 5.2.3.14, 6.1.0 before 6.1.3.4, 6.4.0 before 6.4.2.4) is at risk. Limiting factors: the authentication requirement, the on-prem-only affected CPE (VeloCloud Orchestrator On-Prem, not the SaaS/hosted variant), and network reachability of the orchestrator management plane (typically restricted to admin/management networks), which materially reduces exposure.

This is a moderate-priority, not top-priority, issue. The CVSS 4.0 base score is 8.5, but the signals collectively temper real-world urgency: the vector requires authentication (PR:L), so it is not exploitable by anonymous internet attackers - an attacker must already hold valid credentials on the VeloCloud Orchestrator. EPSS is 2.83% (85th percentile), which is elevated relative to the average CVE but still indicates low absolute likelihood of imminent broad exploitation. CISA SSVC classifies Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial' - all three point to a targeted, non-wormable issue rather than a mass-exploitation event. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is best treated as 'no public exploit identified at time of analysis'. The vendor (Arista) discovered it internally and states it is unaware of any malicious use. The CVSS 4.0 vector shows high vulnerable-system confidentiality (VC:H) with only Low integrity/availability, plus a subsequent-system confidentiality impact (SC:H) that aligns with the described SSRF-style unintended outbound connections. Bottom line: a real vulnerability warranting timely patching for internet- or partner-reachable orchestrators, but the authentication requirement and 'none/no/partial' SSVC profile make it a scheduled-remediation rather than emergency item.

An attacker with valid but low-privileged VeloCloud Orchestrator credentials (e.g., a tenant/operator account, or a phished/leaked login) sends crafted input to a vulnerable API endpoint that is concatenated into a backend SQL query. By injecting SQL, they read tenant/configuration data beyond their assigned privileges and coerce the orchestrator into making attacker-directed outbound network connections (an SSRF-like effect usable to probe or reach internal systems). No public proof-of-concept exploit is currently known, and low attack complexity means a credentialed attacker could act quickly.