VeloCloud Orchestrator privilege escalation exploited in the wild (CVE-2026-114625)

Actively exploited in the wild - CVE-2026-114625 is a critical privilege escalation in on-premises VeloCloud Orchestrator (VCO) that lets any authenticated user gain operator privileges and masquerade as a local “superuser operator,” reaching internal functionality never meant to be remotely reachable. Hosted and Dedicated VCO instances have already been patched; on-prem deployments must update now.

Overview

VeloCloud Orchestrator is the management plane for VMware/Broadcom SD-WAN deployments. It holds device configuration, policy, and operational data for every edge in the fabric, which is why control of the orchestrator is effectively control of the network.

CVE-2026-114625 is an access-control weakness in on-prem VCO. The attacker needs only a valid low-privilege account and network reachability to the orchestrator - no user interaction, no special configuration, low attack complexity. From there, the flaw allows them to escalate to operator level and impersonate a built-in local superuser operator account. That identity unlocks internal-only interfaces and functions that are not intended to be exposed to remote users at all.

CVSS scores it 9.9 (Critical), with the network vector, low complexity, and low privileges reflecting how little an attacker needs to get started. CISA has added the CVE to its Known Exploited Vulnerabilities catalog, meaning real-world exploitation has been confirmed. The EPSS score is low at roughly 0.6%, consistent with a targeted vulnerability that requires a foothold account rather than mass internet scanning - but KEV status outweighs that signal for prioritization.

Impact

Successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages. In practical terms, an attacker with superuser operator access can read or alter SD-WAN policy and edge configuration, disrupt connectivity across the fabric, and potentially pivot toward managed devices. Because the orchestrator is a trust anchor, downstream impact can extend well beyond the VCO host itself.

Remediation and Mitigation

• Patch on-prem VCO immediately. Hosted and Dedicated environments are already fixed; on-prem customers must apply the current fixed release from Broadcom/VMware. Check the vendor advisory for the exact build.
• Treat KEV status as a deadline. Federal agencies have a binding remediation date; private organizations should match that urgency.
• Restrict exposure. Do not expose the orchestrator management interface to the internet. Put it behind VPN or a zero-trust access gateway and limit source IPs.
• Audit accounts and sessions. Review all VCO users for unexpected operator-level roles, look for recently created or modified superuser operator activity, and rotate credentials for accounts with orchestrator access.
• Hunt for indicators. Search logs for privilege changes, anomalous API calls to internal-only endpoints, and configuration pushes that were not authorized.

If you suspect compromise, preserve logs and review our breach reports and security news coverage for context on SD-WAN targeting.

Security Insight

This CVE lands in a pattern that has defined SD-WAN security for several years: the management plane is the softest target in the fabric, and attackers know it. Where past campaigns against edge appliances relied on internet-facing appliance bugs, CVE-2026-114625 shows the orchestrator itself is now in scope, and that a single low-privilege account is enough to unravel the trust model. The fact that hosted instances were patched before the on-prem advisory is a reminder that cloud-managed customers get fixes on the vendor’s schedule, while on-prem operators carry the exposure themselves.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs