## Overview
CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities (KEV) catalog on October 23, 2026. This vulnerability affects the VeloCloud Orchestrator (VCO) on-premises version. It allows authenticated users to exploit SQL injection flaws, gaining unauthorized access to sensitive internal functions.
## Technical Details
The vulnerability permits any authenticated user to elevate their privileges to that of a superuser operator. This access includes functionality meant for internal use only, which should not be exposed to remote users. Attackers can leverage this flaw to manipulate the orchestrator and the data it manages. The CVSS score of 9.4 indicates a critical risk level. Evidence of exploitation has prompted CISA's swift action to include this vulnerability in the KEV list.
## Impact
Successful exploitation can compromise the confidentiality, integrity, and availability of the VCO and its managed data. This could lead to unauthorized data access or manipulation, significantly affecting organizations relying on the VeloCloud Orchestrator for network management. The vulnerability impacts both hosted and dedicated versions of VCO, although patches have been issued for these versions.
## Mitigation
Organizations using VeloCloud Orchestrator should apply the latest security patches immediately. Regularly review user access levels to ensure that only necessary permissions are granted. Monitor systems for any unusual activity that may indicate exploitation attempts. Implement additional security measures, such as web application firewalls, to help mitigate SQL injection risks.
CSURFACE Threat Sensor