An authenticated tenant user can exploit the issue to impersonate a superuser operator. Arista says Hosted and Dedicated services have been patched. Organizations running VCO themselves must check their deployed release.
Oktsec recommends preserving authentication and administrative records before making changes, then checking for unexpected privileged activity. The advisory does not mean every Arista product is affected.
Affected systems and fixes
Product
Affected
Fixed release / action
VCO 5.2.x
Before 5.2.3.18
5.2.3.18
VCO 6.1.x
Before 6.1.3.10
6.1.3.10
VCO 6.4.x
Before 6.4.2.12
6.4.2.12
Confirm the running version against the vendor advisory, including any distribution backports.
CISA exploitation evidence
Catalog 2026.10.23 · Checked Oct 24, 2026 UTC
CISA lists this CVE in its Known Exploited Vulnerabilities catalog. This confirms known exploitation, not compromise of your environment.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA’s federal deadlines and requirements are shown for context. They are not a universal deadline for private organizations or businesses in Latin America. The date added is the catalog inclusion date, not the first attack date.
Arista
Response checklist
0 of 3 complete
Sources
Technical facts come from these sources. Priorities and suggested reviews are Oktsec’s analysis.