Security Advisory 0183
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
VeloCloud Orchestrator (VCO) on-premises has a security flaw that allows remote attackers to access privileged administrative functions without proper authorization, potentially compromising the entire system and all data it manages.
CWE-20 (Improper Input Validation) vulnerability in VCO on-prem enables remote unauthenticated or low-privileged attackers to bypass access controls and invoke privileged internal functionality. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the orchestrator platform and managed infrastructure. Hosted/Dedicated versions have been remediated.