1. Apply patches immediately: upgrade to VCO versions 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1 or later. 2. Restrict access to the VCO web interface to administrative networks only. 3. Block known malicious IPs: 8.19.75.217, 206.72.242.124, 206.72.242.162. 4. Monitor VCO logs for: unusual web requests with encoded characters or abnormal request rates, unexpected outbound HTTP/HTTPS traffic, unauthorized configuration changes or privileged maintenance activity, unexpected command execution or file creation, suspicious access to VCO databases, credentials, certificates, or cryptographic keys. 5. Rotate credentials for all VCO-managed accounts. 6. Review administrator activity and validate managed devices. 7. If compromise is suspected, preserve logs and filesystem timestamps before remediation. 8. Consider restoring or replacing potentially compromised instances, as patching alone may not be sufficient for already-breached systems. 9. Organizations running end-of-support VCO versions should contact Arista TAC for upgrade options. 10. CISA-mandated deadline for U.S. federal civilian executive branch agencies: July 30, 2026.