VeloCloud Orchestrator EUVD-2026-49371

Vendor-released patch: upgrade VeloCloud Orchestrator On-Prem to 5.2.3.14 (from the 5.2.0 branch), 6.1.3.4 (from the 6.1.0 branch), or 6.4.2.4 (from the 6.4.0 branch) as documented in Arista security advisory 0145 at https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145; because the flaw is reachable by any authenticated API user on an affected build, patching should be prioritized over configuration workarounds where the orchestrator is Internet-exposed or shared with lower-trust administrative accounts. Where immediate upgrade is not possible, compensating controls should focus on the authentication prerequisite and on limiting blast radius: restrict management-API reachability to a dedicated administrative network or jump host via firewall/ACL rules (trade-off: legitimate remote operators lose direct access and must route through the bastion), review and trim orchestrator accounts so that only fully trusted administrators retain API credentials, and rotate or disable credentials for any user who should not have backend query visibility (trade-off: additional account administration overhead and possible disruption to automation using shared service accounts). Because successful exploitation can drive unintended outbound connections from the orchestrator, add or tighten egress filtering on the orchestrator subnet so it can only reach known, required management endpoints (trade-off: false positives and blocked legitimate updates/telemetry if allowlists are too narrow), and monitor orchestrator and database logs for anomalous query errors or unexpected outbound traffic as a detection backstop. Note that per the available data no public exploit code or active exploitation has been observed, and no vendor workaround short of upgrading is documented.