VeloCloud Orchestrator Zero-Day. Patch. Restrict. Hunt.

Upgrade every on-prem VCO

Check the VCO version and upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later on your train. Orchestrators patched only for September's CVE-2026-93952 (5.2.3.16 or 6.4.2.8) are below these fixed versions and still vulnerable. On an unsupported release train, contact Arista TAC about upgrade options. If you suspect compromise, preserve logs first (see Reactive).

Restrict the web interface

Limit access to the VCO web UI to trusted administrative networks. Do not leave it open to the internet.

Audit accounts

Review every operator, partner and customer account. Remove ones that are not needed and check for accounts or role changes you cannot explain. Any valid login, even read-only, is enough to exploit this flaw.

Limit outbound traffic

Block outbound ports the VCO does not need for normal operation, and alert on unexpected outbound connections from the VCO host.

Attacker IPs

Block the two IP addresses Arista published and search firewall, proxy and VCO web logs for them.

grep -E "74\.82\.197\.86|38\.54\.50\.151" /path/to/vco/web/access.log*

Web access log patterns

Review VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, and spikes in request rate, especially from low-privilege accounts.

Host and admin activity

Look for unexpected outbound connections from the VCO host, backdoor daemons, webshells and administrator changes nobody can explain.

Preserve and respond

Before upgrading, where operationally feasible, preserve VCO web access, backend application, system and database logs and relevant file-system timestamps. If compromise is confirmed, treat the customer tenants and connected Edges managed by that orchestrator as exposed and run incident response.

Detection pack: KQL and Sigma

Hunts from the CybaVerse threat hunt team for Microsoft Sentinel and Defender XDR: the attacker IPs in both directions, web access anomalies, request spikes, new outbound connections from the VCO host and an admin-change starting point. Two Sigma rules cover the web and firewall views. Run them in CybaOps or your own SIEM.

The KQL has not been run on a live tenant. Set your VCO hosts and validate table and field names before relying on results.

Loading queries. If they don't appear, download the full pack below. The .kql file is inside it.

title: VeloCloud Orchestrator Web Access From Arista-Published IOC IPs or URL-like/Encoded Path Segments (CVE-2026-114625)
id: 6f1d2c3a-8b4e-4f0a-9c71-2a5e0d114625
status: experimental
description: |
  Hunts VCO nginx/web access logs for the two source IPs Arista published in Security Advisory 0199
  and for generic anomalies Arista advises reviewing (URL-like path components, encoded slashes,
  references to local services). Generic by design; contains no exploit payload. Untested in production.
references:
  - https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
author: Oliver Spence
date: 2026-10-22
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2026-114625
logsource:
  category: webserver
detection:
  sel_ioc:
    c-ip:
      - '74.82.197.86'
      - '38.54.50.151'
  sel_urllike:
    cs-uri-stem|contains:
      - 'http://'
      - 'https://'
      - 'http%3a'
      - 'https%3a'
      - '%2f%2f'
      - 'localhost'
      - '127.0.0.1'
      - '0.0.0.0'
  condition: sel_ioc or sel_urllike
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate redirect or callback parameters; scope this rule to VCO hosts only
level: high

title: Network Connection To or From Arista-Published VeloCloud Orchestrator Attacker IPs (CVE-2026-114625)
id: 9a7c4e21-3d5b-4b8e-a1f6-7e0c2b114625
status: experimental
description: Connections involving IPs Arista observed conducting CVE-2026-114625 attacks (Security Advisory 0199).
references:
  - https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
author: Oliver Spence
date: 2026-10-22
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2026-114625
logsource:
  category: firewall
detection:
  sel_src:
    src_ip:
      - '74.82.197.86'
      - '38.54.50.151'
  sel_dst:
    dst_ip:
      - '74.82.197.86'
      - '38.54.50.151'
  condition: 1 of sel_*
falsepositives:
  - None expected; IPs may be reassigned over time
level: high