Affected Systems
Arista VeloCloud Orchestrator (VCO) On-Prem deployments. Patched versions: 5.2.3.18+, 6.1.3.10+, 6.4.2.12+. Hosted VCO instances already patched. Unpatched on-prem deployments remain vulnerable.
Exploitation Status
Active exploitation confirmed. Arista has identified malicious activity from IP addresses 74.82.197.86 and 38.54.50.151. Attackers require valid authenticated session and basic user privileges to exploit.
Business Impact
Authenticated attackers can escalate to superuser operator privileges via low-complexity SQL injection, gaining access to internal functionality not intended for remote access. Full compromise of orchestrator confidentiality, integrity, and availability is possible, affecting SD-WAN management and configuration. This is the fourth actively exploited Arista zero-day in 2026.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update VCO On-Prem to patched versions: 5.2.3.18 or later, 6.1.3.10 or later, or 6.4.2.12 or later
- Block IP addresses 74.82.197.86 and 38.54.50.151 at perimeter and internal firewalls
- Restrict VCO web interface access to administrative networks only; implement IP allowlisting if not already in place
- Review VCO web access logs for SQL injection indicators: unusual URL-like path components, encoded characters, references to local/internal services, and abnormal request rates
- Audit recent administrator activity and privilege escalations for unauthorized changes; preserve logs (web access, backend application, system, database) if compromise is suspected before remediation