Arista Issues Emergency Patch for Actively Exploited VeloCloud Orchestrator Zero‑Day

Arista Networks announced on Tuesday that it has released security updates to close a zero‑day flaw in its VeloCloud Orchestrator (VCO) on‑premises deployment, a vulnerability that security researchers say is currently being leveraged in the wild.

The flaw, identified as a remote code execution weakness in the VCO management interface, allows an unauthenticated attacker to execute arbitrary commands on the orchestrator server. Early indications from threat‑intelligence feeds suggest that malicious actors have been scanning for vulnerable installations and have successfully compromised at least a handful of networks, prompting the rapid public disclosure.

VCO is a core component of Arista’s SD‑WAN solution, providing centralized configuration, monitoring, and policy enforcement for distributed branch offices. Organizations that host the orchestrator on‑premises—often to meet data‑ residency or compliance requirements—are especially exposed because the vulnerable service is reachable from internal networks and, in some configurations, from the internet. Compromise of the orchestrator could grant attackers control over traffic routing, enable data interception, or serve as a foothold for further lateral movement.

In response, Arista has made the patches available through its regular software‑distribution channels and is urging customers to apply them immediately. The company’s advisory notes that the update addresses the root cause of the vulnerability and includes additional hardening recommendations, such as restricting access to the orchestration API and enabling multi‑factor authentication for administrative accounts. Arista also pledged to monitor the situation and release any supplementary fixes if needed.

Security experts recommend that affected enterprises verify the patch deployment, review logs for signs of prior exploitation, and conduct a thorough audit of their SD‑WAN environments. The incident underscores the broader challenge of maintaining timely updates for on‑premises network infrastructure, where patch cycles can be slower than in cloud‑native services. As the threat landscape evolves, vendors and operators alike are being reminded that even well‑established networking platforms remain attractive targets for sophisticated attackers.