Act
active
Arista patches VeloCloud Orchestrator zero-day exploited in attacks
- Engineer — Act: If you run VeloCloud Orchestrator On-Prem, apply Arista’s security update immediately — active exploitation means this is not wait-and-see. Verify your VCO version and patch to the fixed release named in Arista’s advisory.
- SOC/IR — Act: Active exploitation of a network orchestration platform warrants an assume-breach posture for any org running VCO On-Prem; hunt for anomalous access or config changes on VCO instances since before the patch date and check Arista’s advisory for any published IOCs.
- Leader — Plan: If VeloCloud Orchestrator is in your environment, confirm your team has patched and assess whether exploitation occurred before the patch window; no broader board-level event unless your org was targeted.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.