What happened
Attackers have exploited a critical-severity vulnerability within the VeloCloud Orchestrator, identified as a zero-day flaw. This SQL injection vulnerability permits unauthorised access to privileged internal system functionalities and allows attackers to escalate their privileges to operator level. The zero-day was exploited in the wild, with active attacks confirmed at the time of reporting. No patches or fixes from the vendor were available at the time of disclosure, indicating the vulnerability was unpatched and at high risk of exploitation.
Who is affected
Organisations running affected deployments of the VeloCloud Orchestrator should consider these systems as vulnerable. Any environment deploying the product during the period of active exploitation is susceptible to compromise through this zero-day flaw. Organisations should recognise the high severity and the potential for unauthorised internal access, which could lead to further malicious activity or data breaches.
Recommended actions
- Review network access controls to limit connections to the affected systems and prevent unauthorised access.
- Implement strict monitoring of system logs for signs of unusual activity that may indicate exploitation or ongoing compromise.
- Conduct thorough security assessments and threat hunting on systems hosting the affected deployment to verify integrity.
- Monitor security advisories from the vendor and apply security patches or mitigations once available.
