---
title: Hunt: VeloCloud Orchestrator CVE-2026-114625, two attacker IPs, odd URL paths and new backdoor daemons on the VCO host | ctxsec
url: https://ctxsec.com/items/hunt-arista-vco-cve-2026-114625
description: ""
status: "hunt idea (Arista Advisory 0199 IOCs and guidance)"
published: 2026-10-22
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-arista-vco-cve-2026-114625.md)

hunt idea (Arista Advisory 0199 IOCs and guidance)

2026-10-22

### Hunt: VeloCloud Orchestrator CVE-2026-114625, two attacker IPs, odd URL paths and new backdoor daemons on the VCO host

Arista's advisory gives enough to start a hunt on on-prem VCO before and after upgrading:

1. **Preserve first**: copy VCO web access logs, backend application logs, system logs, database logs and file-system timestamps before remediation.
2. **Known attacker IPs**: search web and firewall logs for `74.82.197.86` and `38.54.50.151`.
3. **Request shape**: flag VCO web requests with unusual URL-like path components, encoded characters, references to local or internal services, and high request rates, especially from low-privilege (Enterprise Read Only) sessions.
4. **Host**: look for unexpected outbound connections from the VCO host, backdoor daemons and webshells.
5. **App**: review recent administrator and operator-level changes you can't account for.

Sources: [Arista Security Advisory 0199](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)