VeloCloud Orchestrator (VCO) on‑prem is affected by a privilege escalation flaw that allows an authenticated user to gain operator privileges and impersonate a “superuser operator”. This privileged level grants access to internal functions that are normally restricted, potentially exposing configuration data, orchestrator controls, and the underlying host system. As a result, an attacker can compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages.

The vulnerability affects Arista Networks' VeloCloud Orchestrator, including all hosted and dedicated deployments. Fixed releases are: VCO 5.2.3.18 and later in the 5.2 train, VCO 6.1.3.10 and later in the 6.1 train, and VCO 6.4.2.12 and later in the 6.4 train. Versions earlier than these are impacted.

The CVSS score of 9.4 indicates a critical severity. Because a successful exploit requires authentication, an attacker must first compromise an account or use valid credentials. The EPSS score is not available, but the lack of it does not diminish the high impact of the flaw. The vulnerability is not listed in CISA's KEV catalog, yet the flaw is publicly known and could be leveraged by adversaries, especially given its potential to provide persistent administrative access.