CVE-2026-114625

Name of the Vulnerable Software and Affected Versions VeloCloud Orchestrator versions prior to 5.2.3.18 VeloCloud Orchestrator versions prior to 6.1.3.10 VeloCloud Orchestrator versions prior to 6.4.2.12

Description An authenticated SQL injection flaw exists in on-premises VeloCloud Orchestrator (VCO) deployments. This issue allows any authenticated user, including those with the lowest Enterprise Read Only tenant role, to escalate privileges and masquerade as a local superuser operator. Successful exploitation enables access to privileged internal functionality not intended for remote access, potentially compromising the confidentiality, integrity, and availability of the orchestrator and the managed data. This flaw has been actively exploited in the wild, with attackers using it to gain full control of the SD-WAN management plane, establish persistence via webshells, and pivot laterally to managed Edge devices.

Recommendations Update VeloCloud Orchestrator to version 5.2.3.18 or later. Update VeloCloud Orchestrator to version 6.1.3.10 or later. Update VeloCloud Orchestrator to version 6.4.2.12 or later. Restrict access to the VCO web UI to authorized admin networks only. Block traffic from the following IP addresses: 74.82.197.86 and 38.54.50.151.