Arista Networks has released security updates for an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. According to the company, the flaw has been used in attacks, which raises the priority for organisations running the platform in their own environments.

For European businesses, the development is relevant because VeloCloud Orchestrator is used to manage SD-WAN infrastructure that connects offices, users and branch networks. A security issue in that layer can have implications for network availability, remote access and the security of connected business systems.

What happened

Arista announced security updates for a newly disclosed zero-day vulnerability in VeloCloud Orchestrator On-Prem. The company indicated that the vulnerability has been actively exploited. The report concerns on-premises deployments rather than a general issue affecting every cloud service using the same name.

A zero-day vulnerability is a security flaw that is exploited before many customers have had time to apply a fix. In practice, that means defenders may have a shorter response window and should treat remediation as urgent.

Why it matters for European businesses

SD-WAN orchestration platforms sit close to critical business operations because they help manage network traffic, branch connectivity and policy enforcement across distributed environments. If attackers gain access to this layer, the impact can extend beyond a single server.

Potential business risks can include:

• disruption to branch or remote-office connectivity
• unauthorised access to network management systems
• increased exposure of connected applications and internal services
• higher incident response costs if attackers use the platform as a pivot point

This is particularly relevant for companies with multiple offices, retail sites, warehouses, hybrid work setups or managed network environments. For regulated sectors, exploitation of infrastructure management systems may also trigger additional internal governance and incident-handling requirements.

Who may be affected

The issue is most relevant to organisations that run VeloCloud Orchestrator On-Prem in their own infrastructure. That can include enterprises and mid-sized businesses using SD-WAN to manage connectivity across locations, as well as service providers and IT teams supporting distributed networks.

Businesses may be more exposed if the orchestrator is internet-facing, insufficiently segmented from other critical systems, or managed under delayed patching cycles. Companies using external IT or network partners should confirm whether those providers operate affected on-premises instances on their behalf.

What companies should consider

• Identify affected deployments: confirm whether your organisation uses VeloCloud Orchestrator On-Prem, directly or via a managed provider.
• Prioritise patching: review Arista's security guidance and apply the available updates as soon as operationally possible.
• Check internet exposure: assess whether the management interface is reachable from the internet and restrict access where possible.
• Review logs and indicators: investigate for signs of suspicious access or administrative activity, especially around exposed management systems.
• Strengthen segmentation: ensure network management platforms are separated from sensitive internal systems to limit lateral movement.
• Coordinate with suppliers: if a third party manages networking infrastructure, request confirmation of patch status and any compromise assessment.

Because Arista stated that exploitation has already occurred, this should be treated as more than a routine maintenance update. For affected organisations, the immediate priority is to determine exposure, patch quickly and review whether the system shows signs of unauthorised activity.