Hunting CVE-2026-114625: What to Look for After the VeloCloud Orchestrator Patch

How to hunt for exploitation of CVE-2026-114625 in VeloCloud Orchestrator: log fields, attributed attacker IPs, evidence preservation order, and why the patch alone is not enough.