Affected Systems
Arista VeloCloud Orchestrator (VCO) on-premises deployments using certificate-based Edge authentication. Affected versions: 5.2.3.15 and earlier, 6.1.3.7 and earlier, 6.4.2.7 and earlier, 7.0.0.2 and earlier. Hosted and Dedicated VCO versions already patched. Fixes available for 5.2 (5.2.3.16+) and 6.4 (6.4.2.8+) trains; 6.1 and 7.0 fixes pending.
Exploitation Status
Actively exploited in the wild as of September 22, 2026. Arista confirmed external discovery and active exploitation. Specific IOCs published including malicious IPs (142.93.149.77, 104.248.126.159), file hashes, and backdoor artifacts.
Business Impact
Remote attackers without credentials can escalate privileges and fully compromise the VCO host, gaining access to managed SD-WAN configuration data and potentially pivoting to all managed Edge devices. This affects organizations using certificate-based Edge authentication. Patches unavailable for 6.1 and 7.0 trains as of advisory date, forcing reliance on mitigations. Organizations must hunt for compromise indicators and perform incident response even after patching.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade VCO to fixed versions: 5.2.3.16+ or 6.4.2.8+. Contact Arista TAC for 6.1 and 7.0 train options.
- Restrict VCO web interface access to trusted administrative networks only via firewall rules or ACLs.
- Hunt for compromise: check nginx logs for x-vc-opt header, scan for files /usr/local/sbin/.vcnode.js and /usr/local/sbin/vc-sysmond (MD5: dc78e206eaeadec59fc5801fe4556bd0), block IPs 142.93.149.77 and 104.248.126.159.
- Monitor VCO for unexpected outbound traffic and block non-essential outbound ports; review administrator activity logs for unauthorized changes.
- If compromise suspected, preserve logs (web access, backend app, system, database) and filesystem timestamps, then engage Arista TAC and perform full incident response including credential rotation and Edge device validation.