What happened
CISA added CVE‑2026‑114625 to its Known Exploited Vulnerabilities catalog. The flaw resides in the on‑premises VCO web interface and allows an authenticated user— even with read‑only rights— to execute arbitrary SQL, elevate to operator level, and masquerade as a super‑user. Exploitation can compromise confidentiality, integrity, and availability of the orchestrator and managed data.
Why it matters for trust and compliance
- The vulnerability exposes a weakness in access‑control and privileged‑account management, a control area that maps to many frameworks (e.g., NIST CSF 2.0 Protect). Demonstrating robust logging and least‑privilege enforcement is now a must‑have audit artifact.
- Continuous monitoring of privileged account activity provides real‑time evidence for auditors.
- Documented role‑based access policies and log retention demonstrate due‑diligence in control assurance.
Who is affected
Technology / SaaS providers Enterprises using SD‑WAN solutions
Recommended actions
- Apply the vendor‑released patch for VCO immediately.
- Enforce multi‑factor authentication and strong password policies for all VCO accounts.
- Review role assignments to enforce least‑privilege principles.
- Enable full‑stack logging (web, app, DB) and forward to a SIEM for continuous analysis.
- Monitor for anomalous request patterns and block known malicious IPs.
Details
- CVEs
- CVE-2026-114625