VeloCloud CVE-2026-114625: read-only must stay read-only

Sources checked: 30 October 2026. FailSafe Research.

A read-only account is still an attacker starting point. Its value as a containment boundary depends on whether the server enforces that limitation across every reachable operation.

The advisory reports active exploitation

Arista advisory 0199, dated 22 October, identifies CVE-2026-114625 in VeloCloud Orchestrator. It says an authenticated user, including the Enterprise Read Only role, can obtain operator privileges on affected systems. Arista reports active exploitation and says hosted versions have been patched.

For on-premises deployments, it lists fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12 for the corresponding release trains. Use the current advisory for exact applicability and upgrade instructions; the vendor notes that end-of-support versions have not been assessed. This should not be described as an unauthenticated vulnerability or a defect in every Arista product.

Model the management plane as a privileged application

Inventory the web interface, administrative APIs, operator identities, integrations and credentials to managed devices. Record which low-privilege roles exist and why they need access. A management application deserves the same object- and function-level authorization review as a customer-facing SaaS product.

Network restrictions can reduce who reaches a service. They do not demonstrate that a legitimate low-privilege session stays within its permissions. Keep network reachability, authentication and authorization as separate test outcomes.

Verify the fix and review the exposure window

Confirm the deployed software on every instance and preserve relevant management, application and system logs where operationally feasible. Follow vendor guidance for investigation if compromise is suspected. A completed upgrade does not prove that an earlier privileged action was authorized.

In a lab or explicitly authorized environment, verify that the restricted role cannot invoke administrative functions, alter another tenant’s state or reach internal capabilities. Capture expected and observed results without publishing an exploit chain. Include session expiry and permissions after a role change.

Connect the finding to the owner of the risk

FailSafe SWARM can test agreed network, application and identity paths and produce evidence an engineering team can reproduce. The useful deliverable describes the privilege gained, what business capability it affects and which controls must change.

For a broader review of administrative integration risks, see our ConnectWise app-identity analysis and BeyondTrust remote-support guide. The incidents differ, but each shows why a privileged management layer belongs in the assessment scope.

Explore the October incident collection for related cases and existing FailSafe coverage. Incident descriptions are attributed to the linked sources; assessment recommendations are FailSafe’s analysis. We have not conducted forensic investigations of these incidents.