title: VeloCloud Orchestrator Web Access From Arista-Published IOC IPs or URL-like/Encoded Path Segments (CVE-2026-114625)
id: 6f1d2c3a-8b4e-4f0a-9c71-2a5e0d114625
status: experimental
description: |
  Hunts VCO nginx/web access logs for the two source IPs Arista published in Security Advisory 0199
  and for generic anomalies Arista advises reviewing (URL-like path components, encoded slashes,
  references to local services). Generic by design; contains no exploit payload. Untested in production.
references:
  - https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
author: Oliver Spence
date: 2026-10-22
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2026-114625
logsource:
  category: webserver
detection:
  sel_ioc:
    c-ip:
      - '74.82.197.86'
      - '38.54.50.151'
  sel_urllike:
    cs-uri-stem|contains:
      - 'http://'
      - 'https://'
      - 'http%3a'
      - 'https%3a'
      - '%2f%2f'
      - 'localhost'
      - '127.0.0.1'
      - '0.0.0.0'
  condition: sel_ioc or sel_urllike
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate redirect or callback parameters; scope this rule to VCO hosts only
level: high