Arista VeloCloud Orchestrator EUVD-2026-49373

Requires an authenticated tenant account with a minimum role of Enterprise Standard Admin on Arista VeloCloud Orchestrator On-Prem; the attacker must reach the specific vulnerable VCO feature that fails to validate caller-supplied input. Realistic impact is further gated by which internal (otherwise non-accessible) services the Orchestrator can route to in a given deployment. Affected: VCO On-Prem 6.1.0<6.1.3.4, 5.2.0<5.2.3.14, and 6.4.0<6.4.2.4; upgrading to the fixed releases removes the condition. Limiting factors: privileged role required (not unauthenticated), no user interaction of a victim needed, and impact is confined to subsequent internal systems rather than the Orchestrator's own confidentiality/integrity/availability.

This is a genuine but bounded, mid-severity issue rather than an urgent priority. The vendor CVSS 4.0 base of 6.3 (AV:N/AC:L/AT:N/PR:L/UI:N) correctly reflects an authenticated, network-reachable SSRF whose damage lands on subsequent internal systems (SC:H/SI:L) rather than on the Orchestrator itself (VC:N/VI:N/VA:N). All exploitation signals point away from imminent mass exploitation: CISA SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing and no public exploit code identified. EPSS is 2.34% (82nd percentile) - modestly elevated versus the median but not indicative of active, widespread exploitation, and it is consistent with the vendor's own statement that the flaw was found internally with no known malicious use. The key limiting factor is the required privilege: exploitation demands a minimum role of Enterprise Standard Admin (PR:L), so this is an authenticated privilege/isolation-boundary bypass, not an unauthenticated internet-facing RCE. No signals are strongly conflicting; the main caveat is that the real blast radius depends on what internal services the Orchestrator can reach, which is deployment-specific.

An attacker holding (or having compromised) an account with at least the Enterprise Standard Admin role sends a crafted request to the vulnerable VCO feature, supplying an input the feature fails to validate. The Orchestrator then issues attacker-directed requests on behalf of the tenant to internal services that are not otherwise reachable, enabling reconnaissance or interaction with back-end systems. No public proof-of-concept or exploit code has been identified at the time of analysis.