SQL injection in VeloCloud Orchestrator (VCO) - CVE-2026-114625
Published: October 23, 2026
Vulnerability identifier: #VU157408
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-114625
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in VeloCloud Orchestrator (VCO) when processing input from the web interface. A remote user can submit crafted input that alters SQL queries to gain operator privileges, impersonate a local superuser operator, and access internal functionality that can affect the VCO host.
Note, the vulnerability is being actively exploited in the wild.
Affected software
VeloCloud Orchestrator (VCO)
How to mitigate CVE-2026-114625
Install security update from vendor's website.
VeloCloud Orchestrator (VCO) - addressed in versions 5.2.3.18, 6.1.3.10, 6.4.2.12