How Exposed Is VeloCloud Orchestrator? Reading ZoomEye Evidence Honestly

When a vendor confirms active exploitation of a management-plane vulnerability, the first question from leadership is usually "how many of these do we have on the internet?" For CVE-2026-114625 in Arista VeloCloud Orchestrator, external search data can inform that answer, but only if the limits of the data are stated as clearly as the number.

What was queried

On 22 October 2026 a ZoomEye device query for the product title fingerprint, title="VeloCloud", returned 520 matching assets. The query was executed against IPv4 device data and the stored count reflects the engine's total at that time.

What the number means

It counts hosts that advertise a VeloCloud-related page title. That is a product-family signal. It is not a count of affected orchestrators, not a count of versions before 5.2.3.18, 6.1.3.10 or 6.4.2.12, and not a count of exploitable systems.
The distinction is not pedantry. VeloCloud branding appears across gateway and edge management surfaces as well as the orchestrator, and Arista states that VeloCloud Gateway and VeloCloud Edge are not affected by this CVE. A matching title can also come from an interface that has since been patched, or from an asset that is not an orchestrator at all.

What the number is still good for

It is a scope indicator. It says that a non-trivial set of VeloCloud-branded interfaces answers from the public internet, which is directly relevant when the vendor states the orchestrator is exposed by default and that no configuration removes that exposure.
A second query with a narrower fingerprint, "VeloCloud Orchestrator" combined with an HTTP service match, returned only a handful of results in the same session. The gap between a broad family signal and a narrow product phrase is exactly the kind of difference that separates "we have a population" from "we located these systems".

Building an internal answer instead

External counts should trigger an internal inventory question, not replace it. Pull the list of orchestrators under management, map each to its release train, and compare against 5.2.3.18, 6.1.3.10 and 6.4.2.12. Then check which of those interfaces accept connections from outside the administrative network.

The exploitation context

Arista reports active exploitation and names two addresses observed in the attacks: 74.82.197.86 and 38.54.50.151. That moves the discussion from theoretical exposure to evidence that someone is looking for these systems.

A defensible summary

Say what was measured, when, with which query, and what it does not prove. Then say what the organisation is doing about the systems it actually owns. That combination survives scrutiny; a headline number on its own does not.