VeloCloud Orchestrator authenticated privilege escalation allows access to internal superuser operator functions (CVE-2026-114625)

What happened

On an affected VeloCloud Orchestrator (VCO) on-prem deployment, any authenticated user with low privileges can gain operator privileges and masquerade as the local 'superuser operator' account. From there the attacker can reach functionality intended for internal use only and not meant to be remotely accessible. Successful exploitation can compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. The CVSS 4.0 score is 9.4 (critical), with a network attack vector, low privileges required and no user interaction.

Exploitation is not theoretical. CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on 2026-10-23, with a due date of 2026-10-26. CISA's SSVC decision marks exploitation as active, and ENISA EUVD records that the flaw has been exploited since 2026-10-23. The CVE record classifies the weakness as CWE-89.

Who is affected

VeloCloud Orchestrator on-prem versions are affected:

• 5.2.0 to before 5.2.3.18
• 6.1.0 to before 6.1.3.10
• 6.4.0 to before 6.4.2.12

The advisory states that hosted, including Dedicated, versions were also impacted and have already been patched. On-prem deployments should be assessed immediately.

What to do now

1. Identify affected VeloCloud Orchestrator on-prem deployments running the versions above. Treat internet-exposed instances as highest priority given the active exploitation.
2. Upgrade to the fixed release for your branch: 5.2.3.18, 6.1.3.10 or 6.4.2.12.
3. Apply the upgrade before CISA's due date of 2026-10-26. CISA's required action is to apply mitigations in accordance with vendor instructions and CISA's BOD 26-04 guidance, including evaluating internet exposure.
4. No workaround is listed in the advisory. If you cannot patch before the due date, restrict network access to the VCO management interface and review local operator accounts for unexpected privilege changes.
5. For hosted or Dedicated VCO, the advisory states these versions have already been patched; confirm with your provider that your instance is on a patched release.

How to detect it

Look for unexpected VCO accounts holding superuser operator privileges or for low-privilege users executing internal-only functions. Review authentication and administrative logs for remote access to the local 'superuser operator' account and for operator-role changes that cannot be explained by change requests. If the VCO management interface is internet-exposed, treat any such access as hostile until reviewed. CISA's KEV entry also refers to CISA's Forensics Triage Requirements.

Beyond the patch

Because this flaw is already being exploited, detection and response are the first line while teams patch. Spirity's Managed Detection & Response (MDR) can watch for suspicious VCO administrative activity, and the Incident Response Retainer provides response capacity if a superuser-operator takeover is suspected. For the underlying authentication weakness, Implementation & Assessment Services can test and harden orchestrator deployments to find similar privilege escalation issues before they are exploited.