Attackers are using an on-prem VeloCloud exploit, CVE-2026-114625 (CVSS 9.9), to turn the lowest-privilege Enterprise Read Only portal account into local superuser on the Arista VeloCloud Orchestrator host. That host runs the SD-WAN management plane for every branch and site it controls. A forgotten login is now the shortest path to the management plane.
