Same product, third time. July was CVE-2026-16812, September was CVE-2026-93952, and today Arista put out Security Advisory 0199 for another VCO flaw that was already being used before the fix shipped.
The mechanics are different this round. The September bug needed cert-based Edge auth turned on and no credentials. This one needs a valid VCO session, but the bar is the lowest built-in tenant role, Enterprise Read Only. Arista’s own wording: VCO is exposed by default and “there is no configuration that can prevent the exposure.” CVSS v3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), v4.0 is 9.4, CWE-89. Tracking bug BUG2043622.
Why that matters on an SD-WAN orchestrator: VCO is multi-tenant by design, so MSPs and big enterprises hand read-only portal logins to customers, branch IT and NOC contractors. Every one of those accounts is now a path to the operator plane. Earlier Arista advisories on this line note that a compromised VCO can reach the Edge devices it manages.
Affected: on-prem VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12. Hosted and Dedicated VCO were hit too and Arista has already patched them. VeloCloud Gateway, VeloCloud Edge, EOS and CloudVision are listed as not affected. End-of-support trains weren’t assessed, so if you’re on one, call TAC.
What I’d do this morning: patch, then go through VCO web access logs for the two attacker IPs Arista published (74.82.197.86 and 38.54.50.151) and for requests with odd URL-like path segments, encoded characters, references to local or internal services, or high request rates. Pull the list of every portal account, kill read-only logins nobody uses, and keep the VCO web UI on admin networks only. If anything looks off, preserve web, application, system and database logs plus file timestamps before you remediate. Arista asks for that so TAC can work the case.
The bigger read: three exploited control-plane bugs in about three months on an orchestrator Arista picked up from Broadcom. BleepingComputer counts four exploited Arista zero-days this year across EOS and VCO. If you run VeloCloud on-prem, the hosted option is starting to look like a security decision, not just an ops one.