VeloCloud Orchestrator: any authenticated user can escalate to superuser operator

CVSS 9.4CVE-2026-114625Firmware, BMC & network fabricKnown exploitedcurated

Impact

On an affected on-prem VCO, any authenticated user can gain operator privileges and act as a local superuser operator, including functionality the vendor intends for internal use and never to be reachable remotely. That means control over the orchestrated network edges and over the data the orchestrator holds - device inventory, tunnel configuration and credentials. CISA lists this as known exploited, so the window between disclosure and attempts is already closed. For a datacenter that terminates its WAN or inter-site connectivity through VeloCloud, this is control of the path traffic takes in and out, not just a management-UI bug.

Who can reach it

Any user with valid credentials to the VCO web interface - the lowest-privileged account is enough. No pre-authentication path is described in the record. Hosted and Dedicated instances were affected and have already been patched by the vendor; on-prem deployments are the operator's responsibility.

What to do

Apply the fixed on-prem VCO release named in Arista's security advisory 0199; the record does not state version numbers, so take them from the advisory. The upgrade restarts the orchestrator, which is a management-plane outage - forwarding on already-configured edges continues, but no new policy can be pushed during the window. Because this is actively exploited, review operator and superuser accounts and audit logs for unexpected privilege use after patching, and keep the VCO UI off any untrusted network.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-114625 https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.