VeloCloud Orchestrator CVE-2026-93952 actively exploited

VeloCloud Orchestrator (VCO) is the central server that manages the Edge devices in a VeloCloud SD-WAN, a software-defined wide area network. On September 22, Arista reported that attackers are actively exploiting a newly identified vulnerability in this orchestrator, tracked as CVE-2026-93952. The flaw carries a CVSS 3.1 severity score of 10.0, the highest possible rating, meaning a successful attack may compromise the orchestrator and the data it manages. According to Arista, a remote attacker with no login access may be able to privilege internal functions and affect the VCO host itself. Notably, only orchestrators configured to authenticate their Edge devices with certificates are exposed, not those using other methods.

The vulnerability was discovered externally and is known to be actively exploited, Arista stated. The company did not say when the attacks began or how widespread they are. The Hacker News has contacted Arista for additional comment. A compromised VCO can also give attackers access to the Edge devices it manages, which makes this particularly serious for businesses that rely on SD-WAN to connect branch offices and remote sites.

VeloCloud Edge devices can authenticate to the orchestrator in one of three modes. In Certificate Deactivated mode, an Edge uses a pre-shared key, which is a secret password configured on both sides. In Certificate Acquire and Certificate Required modes, the Edge uses a certificate issued by the orchestrator. Arista said an orchestrator is exposed to CVE-2026-93952 if certificate based authentication from the VeloCloud Edge to the VCO is configured. The advisory did not specify which of the two certificate modes meet this condition. To exploit the flaw, an attacker also needs network access to the VCO web interface and the public part of an Edge authentication certificate. This is different from a previous VCO flaw reported as exploited in July, tracked as CVE-2026-16812, which affected VCO by default and could not be prevented by any configuration.

As of September 22, fixed releases are available for the 5.2 and 6.4 release trains, but not yet for the 6.1 and 7.0 trains. Arista has already patched the Hosted and Dedicated versions of VCO. The affected releases include those that fixed the July flaw. Specifically, in the 5.2 train, versions 5.2.3.15 and earlier are affected and fixed in 5.2.3.16 and later; the July flaw was fixed in 5.2.3.14. In the 6.1 train, versions 6.1.3.7 and earlier are affected, but no fix is available yet; the July flaw was fixed in 6.1.3.4. In the 6.4 train, versions 6.4.2.7 and earlier are affected and fixed in 6.4.2.8 and later; the July flaw was fixed in 6.4.2.4. In the 7.0 train, versions 7.0.0.2 and earlier are affected, but no fix is available yet; for the July flaw, no fix is listed, and Arista states that 7.0.0.1 and later were not affected.

For customers who cannot upgrade immediately, Arista recommends several steps to reduce risk. Limit access to the VCO web interface to trusted administrative networks. Monitor the VCO for access from known malicious IP addresses. Watch for unexpected outbound network traffic from the VCO host. Consider blocking outbound ports that are not required for normal operation. Monitor for backdoor daemons and webshells, which are hidden programs that allow remote control. Review recent administrator activity for unexpected changes.

Arista said no single indicator proves that a VCO was compromised through this flaw. Check VCO web access logs for requests with unusual URL-like paths, encoded characters, references to local or internal services, or high request rates. Specific indicators to look for include the file /usr/local/sbin/.vcnode.js, the file /usr/local/sbin/vc-sysmond, the MD5 hash dc78e206eaeadec59fc5801fe4556bd0 for vc-sysmond, the file /etc/systemd/system/vc-sysmon.service, the HTTP header x-vc-opt in nginx logs, and the IP addresses 142.93.149[.]77 and 104.248.126[.]159. If any of these are found, Arista advises preserving the state of the VCO and contacting the Technical Assistance Center or the customer account team. If a compromise is suspected, save the VCO web access, backend application, system, and database logs and file-system timestamps before making changes, where practical. After upgrading, Arista recommends incident response steps that may include rotating credentials, reviewing administrator activity, checking the state of managed Edge devices, and restoring or replacing the orchestrator from trusted sources.

For IT teams that run network orchestration platforms like VCO, working with a security-first IT and infrastructure partner such as AEU-I can help review exposure, plan patching, and monitor for compromise indicators. Keeping an orchestrator unpatched while it is actively exploited is a high risk for any business that relies on SD-WAN connectivity, and the indicators above give administrators a concrete way to start an investigation.