CVE-2026-114625: Critical Escalation in VeloCloud Orchestrator

CVE-2026-114625 affects VeloCloud Orchestrator in on-premises deployments. The vulnerability allows any authenticated user to escalate privileges by acquiring operator role and accessing internal-only functionality. This escalation bypasses restrictions and enables access to components not intended for remote access, risking the integrity and availability of the orchestrator.

CVSS score is 9.9, critical level. The vulnerability was published by NVD on October 22, 2026. A relevant signal emerges from GitHub, where an offline detector was published on October 28 to identify exposure on on-premises instances. Hosted versions of VeloCloud have already been patched; on-prem deployments remain vulnerable until patching is applied.

On-prem administrators must contact the vendor to obtain updates and plan patching urgently. Use the GitHub detector to identify which instances are exposed. Meanwhile, review access logs and audit permissions of authenticated users, restricting privileges to accounts that genuinely require elevated access.

VeloCloud Orchestrator is the central management system for enterprise SD-WAN networks. An orchestrator compromise exposes the entire network infrastructure to the attacker, allowing configuration changes, traffic interception, and edge device control. This vulnerability's criticality reflects the product's crucial role in enterprise architectures.