Read-Only Was Never Harmless: Identity Lessons from CVE-2026-114625

The CVE-2026-114625 vulnerability in Arista VeloCloud Orchestrator challenges the conventional wisdom that read-only access poses no significant risk. This flaw allows any authenticated user to elevate their privileges to operator level, granting access to internal-only functionality that should remain inaccessible remotely. The most concerning aspect is that this access can be obtained using the lowest built-in customer role, known as Enterprise Read Only.

This means that any credentials capable of logging into the orchestrator, whether belonging to individuals, integrations, or forgotten service accounts, can be exploited. Such credentials accumulate over time, often unnoticed, and their unchecked growth can lead to numerous authentication primitives that attackers can leverage against a highly critical vulnerability (CVSS 9.9) resulting from a SQL injection.

The solution involves applying specific patches to certain versions of the software (5.2.3.18, 6.1.3.10, or 6.4.2.12), conducting a thorough account inventory review to eliminate unused or improperly assigned accounts, and restricting web interface access to trusted administrative networks. Additionally, monitoring administrator activity for any unauthorized changes and vigilantly scanning for potential backdoor daemons or web shells is recommended, as they may provide persistence despite credential changes.

The timing of the initial attacks, the specific orchestrator versions affected, and the post-exploitation activities of the attackers remain undisclosed, emphasizing the need for a comprehensive identity management approach that considers not just the patched host, but also the potential misuse of any compromised credentials.