CVE-2026-114625: Security Advisory 0199
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VeloCloud Orchestrator (VCO)to a version that resolves this vulnerability.Fixed in 5.2.3.18 - Upgrade
Upgrade
VeloCloud Orchestrator (VCO)to a version that resolves this vulnerability.Fixed in 6.1.3.10 - Upgrade
Upgrade
VeloCloud Orchestrator (VCO)to a version that resolves this vulnerability.Fixed in 6.4.2.12
Event History
Frequently Asked Questions
Which deployments still need remediation?
The issue applies to VeloCloud Orchestrator on-prem deployments. Hosted VCO deployments, including Dedicated versions, were impacted but have already been patched.
What access does an attacker need to exploit this issue?
An attacker needs an authenticated VCO user account. Any authenticated user on an affected system may be able to obtain operator privileges and impersonate a local superuser operator.
What could an attacker do after successful exploitation?
The attacker may access privileged internal-only functionality that is not intended to be remotely accessible and impact the VCO host. The orchestrator and the data it manages may be compromised in confidentiality, integrity, and availability.