VeloCloud Orchestrator SQL injection allows authenticated users to reach superuser operator functions (CVE-2026-114625)

What happened

CVE-2026-114625 is a SQL injection weakness in VeloCloud Orchestrator (VCO). On an affected on-prem deployment, any authenticated user can gain operator privileges and masquerade as the local "superuser operator" user. This grants access to functionality that is intended for internal use only and should not be remotely accessible. Successful exploitation can compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.

The CVSS 4.0 score is 9.4 (critical). The vector describes an attack over the network that requires low privileges and no user interaction; the vulnerable system and subsequent systems are all rated high impact for confidentiality, integrity and availability.

CISA KEV lists this CVE as exploited. CISA SSVC assesses active exploitation, and ENISA EUVD records exploitation since 23 October 2026. CISA's KEV due date for action is 26 October 2026.

Who is affected

On-premises VeloCloud Orchestrator deployments are affected. Affected version ranges: 5.2.0 to before 5.2.3.18; 6.1.0 to before 6.1.3.10; 6.4.0 to before 6.4.2.12. This is the central orchestrator component; successful compromise affects the orchestrator and the data it manages. Hosted, including Dedicated, versions were impacted and have already been patched, according to the vendor's Security Advisory 0199.

What to do now

1. Upgrade affected on-prem VCO deployments to a fixed release: 5.2.3.18, 6.1.3.10, or 6.4.2.12.
2. If you use hosted or Dedicated VCO, confirm with the vendor that your instance has already been patched; the advisory states those were patched.
3. Until patching is complete, restrict network exposure to the VCO management interface and monitor for unexpected privilege changes or use of internal-only functionality.
4. Treat CISA KEV's due date, 26 October 2026, as the deadline for applying vendor mitigations under BOD 26-04 prioritisation guidance.

How to detect it

Review VCO access logs for ordinary authenticated accounts gaining operator privileges, masquerading as the local 'superuser operator' account, or accessing internal-only functionality. Treat any internet-exposed VCO as a higher priority; CISA's KEV entry asks asset owners to evaluate internet exposure and follow BOD 26-04 patching guidelines.

Beyond the patch

Because this flaw is already being exploited, detection and response are the first priority after patching. Spirity's Managed Detection & Response (MDR) can monitor for privilege escalation and abuse of the internal-only access described here. For longer-term hardening, Implementation & Assessment Services are designed to find injection and authentication flaws before they are added to the KEV list.