VeloCloud Orchestrator CVE-2026-114625: role design, host impact and the limits of the advisory

The advisory for CVE-2026-114625 describes more than privilege escalation, and two of its statements are worth separating.

First, the flaw lets an authenticated low-privilege user act as a local superuser on the orchestrator. Second, it may allow an attacker to affect the VCO host itself, exposing, modifying or disrupting the orchestrator and the data it manages.

The first is an application-level privilege boundary crossing. The second reaches the operating host.

The role model in VeloCloud Orchestrator

VCO is built for multi-tenant SD-WAN management. Operators create customer and partner accounts. Partners manage groups of customers. Customer users have roles, and Enterprise Read Only is the lowest built-in role for them.

The design assumes those roles constrain what a session can do. A read-only customer sees inventory and reports. An operator changes configuration. CVE-2026-114625 is a SQL injection that collapses the gap: a crafted request from a read-only session runs with superuser context.

Arista rates it 9.9. It is being exploited.

Conditions the attacker needs

Reachability of the VCO web interface. Arista states VCO is exposed by default and no VCO setting prevents it.
A valid login at Enterprise Read Only or above.

Those conditions are ordinary in enterprise and managed-service deployments. Partner staff, auditors and monitoring integrations routinely hold read-only access.

Of the three VCO flaws Arista has reported as exploited since late July, this is the only one that asks for a login. CVE-2026-16812 and CVE-2026-93952 did not.

Why the host statement matters

If the impact were limited to the application, patching the orchestrator would close the issue. The advisory's host statement widens the scope. An attacker with superuser context may reach beyond the web application, which is why the response guidance includes host-level checks: unexpected outbound network activity, unnecessary outbound ports, backdoor daemons and webshells.

Those are host checks, not application checks. They belong in the plan alongside the version upgrade.

Scope of affected versions

Train	Fixed release
5.2	5.2.3.18
6.1	6.1.3.10
6.4	6.4.2.12

On-premises orchestrators below those builds are affected. Hosted and Dedicated orchestrators were patched by Arista. VeloCloud Gateway and VeloCloud Edge are not affected. The 7.0 train is not listed, and Arista says unlisted releases are not vulnerable. End-of-support releases were not evaluated and are referred to Arista TAC.

Fixes for the July and September flaws are older than these builds, so an orchestrator patched in the summer remains exposed.

Gaps in the public record

The advisory does not say when exploitation began, which orchestrators were attacked, or what the attackers did afterwards. It does not say whether upgrading removes access already gained. It does not say whether a compromised orchestrator still exposes edge devices, a risk the July and September advisories raised.

Each gap shifts work to the defender: preserve evidence, verify the operator tier, and review recent administrator activity instead of assuming that a successful upgrade also resolved an intrusion.

Detection inputs

Arista names two addresses seen in the attacks, 74.82.197[.]86 and 38.54.50[.]151. In VCO web access logs it points to unusual URL-like path components, encoded characters, references to local or internal services, and high request rates. Evidence to preserve before remediation includes web access, backend application, system and database logs, plus file-system timestamps.

Exposure

ZoomEye returns 529 assets for title="VeloCloud". This measures visible VeloCloud web surface, not confirmed vulnerable orchestrators, and it should be read as an indicator of where such interfaces are published rather than as an impact count.