- Engineer — Act: VeloCloud Orchestrator On-Prem is actively exploited network management infrastructure — apply Arista’s released patches immediately and treat all unpatched VCO instances as potentially compromised.
- SOC/IR — Act: Active exploitation means systems may have been compromised before patches were available — sweep VCO On-Prem hosts for anomalous admin activity, lateral movement, and configuration changes since the zero-day window opened.
- Leader — Act: Actively exploited zero-day in SD-WAN management infrastructure warrants same-week action — confirm whether VCO On-Prem is deployed, verify the patch has been applied or is on an emergency timeline, and brief IT leadership on exposure status.