title: Network Connection To or From Arista-Published VeloCloud Orchestrator Attacker IPs (CVE-2026-114625)
id: 9a7c4e21-3d5b-4b8e-a1f6-7e0c2b114625
status: experimental
description: Connections involving IPs Arista observed conducting CVE-2026-114625 attacks (Security Advisory 0199).
references:
  - https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
author: Oliver Spence
date: 2026-10-22
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2026-114625
logsource:
  category: firewall
detection:
  sel_src:
    src_ip:
      - '74.82.197.86'
      - '38.54.50.151'
  sel_dst:
    dst_ip:
      - '74.82.197.86'
      - '38.54.50.151'
  condition: 1 of sel_*
falsepositives:
  - None expected; IPs may be reassigned over time
level: high