Last Updated: 2026-09-22T22:18:11Z
Arista published a security advisory today regarding its VeloCloud Orchestrator.
The perfect-10 CVSS vulnerability:
…may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Yes, it “may” indeed. It’s now confirmed exploited and on CISA’s KEVs as of today.
There is a configuration requirement for the vulnerability:
VCO is exposed if certificate based authentication from the VeloCloud Edge to VeloCloud Orchestrator (VCO) is configured. Access to the public portion of the VeloCloud Edge authentication certificate is required. A successful attack requires network access to the VCO web interface. VCO tenant or operator credentials are not required for this exposure.
So, sounds like the same story about not putting management interfaces on the internet.
Affected Versions
Per Arista:
- 5.2.3.15 and below releases in the 5.2.x train
- 6.1.3.7 and below releases in the 6.1.x train
- 6.4.2.7 and below releases in the 6.4.x train
- 7.0.0.2 and below releases in the 7.0.x train.
Actions
Upgrade to:
- VCO 5.2.3.16 and later in the 5.2.3 train
- VCO 6.4.2.8 and later in the 6.4.2 train
Observables
Arista has listed the following observables for exploitation:
| Value | Type | Description |
|---|---|---|
/usr/local/sbin/.vcnode.js |
Path | Dropped Payload |
/usr/local/sbin/vc-sysmond |
Path | Dropped Payload |
dc78e206eaeadec59fc5801fe4556bd0 |
MD5 (seriously) | Hash of vc-sysmond |
/etc/systemd/system/vc-sysmon.service |
Path | Dropped Payload |
x-vc-opt |
HTTP Header | Exploit Indicator in Request |
142.93.149[.]77 |
IPv4 | Attacker IP |
104.248.126[.]159 |
IPv4 | Attacker IP |
These have been added to our MISP feed.
Notes
This comes on the heels of a recent perfect 10 for Arista’s VCO.
