CVE-2026-93952

What is VeloCloud Orchestrator?

VeloCloud Orchestrator (VCO) is the management and control plane of the VeloCloud SD-WAN platform, originally VMware's and now Arista's after the 2025 acquisition. Every VeloCloud Edge appliance in a deployment, the boxes sitting in branch offices, data centers and cloud VPCs, registers with the Orchestrator, receives its configuration and business policy from it, and reports telemetry back to it. Administrators run the whole WAN from the VCO web interface.

That architecture is why a VCO compromise is not one server's problem. The Orchestrator can push configuration to every Edge it manages, which means an attacker who owns it can re-route or mirror WAN traffic across an entire enterprise, alter the policy that decides which flows are inspected, and reach into branch networks through devices that already trust the control plane. Arista's own advisory notes that a compromised VCO may give an attacker access to the Edges it manages.

Overview

CVE-2026-93952 is an improper input validation flaw in on-premises VeloCloud Orchestrator. Input arriving at the web interface is not filtered properly, which lets a remote attacker with no login reach privileged internal functionality and act on the VCO host. Arista rates it CVSS 3.1 10.0, the maximum, with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; the Changed scope is what carries it past 9.8, reflecting that the impact does not stop at the vulnerable component. Arista also publishes a CVSS 4.0 score of 9.5.

Arista disclosed the flaw on 2026-09-22 in Security Advisory 0183, stating that it was found externally and is known to be actively exploited. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a 2026-09-25 deadline.

Exploitation is conditional on how Edges authenticate. Only Orchestrators configured for certificate-based Edge authentication, the Certificate Acquire and Certificate Required modes, are exposed; deployments still using pre-shared keys are not. The attacker also needs network access to the VCO web interface and the public portion of an Edge's authentication certificate. A certificate's public half is not a secret in the way a credential is, which is what keeps the attack complexity Low despite the precondition.

This is the second maximum-severity VeloCloud flaw exploited in the wild in 2026. CVE-2026-16812, an unauthenticated OS command injection also scored 10.0, was disclosed in July.

Affected Versions

Customers on the 6.1 and 7.0 trains had no released fix on the day the CVE went public and the KEV clock started. Those deployments need the mitigations below immediately rather than a patch window.

Technical Details

The weakness is CWE-20, improper input validation: the application accepts input and acts on it without first checking that it is well-formed and permitted. Here the missing check sits on the path that handles Edge certificate authentication at the web interface, and the consequence is an authorization bypass. Input that should have been rejected instead reaches internal functionality the web tier is supposed to expose only to authenticated, privileged callers, and from there the attacker can affect the VCO host itself. Arista has not published the specific parameter or endpoint, and no proof-of-concept is public.

The attack characteristics: no credentials, no user interaction, low complexity, no chaining with a second CVE. The preconditions are configuration state (certificate-based Edge authentication) and possession of an Edge certificate's public portion, not attacker skill. Reachability of the VCO web interface is the practical gate, and an Orchestrator generally has to be reachable by every Edge it manages, which in most deployments means reachable from the internet.

Published indicators point at what follows exploitation rather than the trigger itself: the HTTP header x-vc-opt appearing in nginx access logs, unexpected files such as .vcnode.js and vc-sysmond installed as backdoor services, outbound connections to unfamiliar addresses, and configuration or administrative activity nobody can account for.

Discovery

Arista credits the discovery to an external party and states the vulnerability was found through, or in connection with, real attacks rather than internal testing. The advisory does not name the reporting researcher or organization, and no individual or team has claimed it publicly. Arista acted as CNA and published the CVE record with Security Advisory 0183 on 2026-09-22. Rapid7 has an open tracking issue proposing a Metasploit detection module, but no working exploit module or PoC existed at the time of writing.

Exploitation Context

Arista confirms active exploitation but has published no victim count, no targeted sectors, and no threat-actor attribution. The IOC list is the most informative public artifact: intrusions have installed persistent backdoor services on the VCO host, including a malicious vcnode.js script and a vc-sysmond binary, which describes an actor interested in durable access to the control plane rather than in a smash-and-grab.

No Shodan, Censys or Shadowserver exposure figure specific to this CVE has been published. The population at risk is narrower than the affected-version list implies: on-premises only (hosted and dedicated instances are already patched) and only those using certificate-based Edge authentication. CISA does not flag the CVE as used in ransomware campaigns.

Worth noting for anyone assessing residual risk: this is the second exploited 10.0 in this product in three months, after CVE-2026-16812 in July. An Orchestrator that was internet-reachable and unpatched through the summer should be reviewed against both.

Remediation

1. Upgrade on-premises VCO to 5.2.3.16 or later on the 5.2 train, or 6.4.2.8 or later on the 6.4 train.
2. If you run the 6.1 or 7.0 train, contact Arista support for a fixed build or hotfix. There was no released fix for these trains at disclosure, so plan on mitigations holding the line in the meantime.
3. Restrict access to the VCO web interface to trusted networks. Edges need to reach the Orchestrator, but the management interface rarely needs to be open to the entire internet; front it with an allowlist covering known Edge egress addresses and administrative ranges.
4. If you authenticate Edges with pre-shared keys rather than certificates, confirm that is still true across the whole deployment before concluding you are unaffected. The exposure follows the Certificate Acquire and Certificate Required modes.
5. Hunt for the published indicators: x-vc-opt headers in nginx access logs, the files .vcnode.js and vc-sysmond or other unexpected services on the VCO host, outbound connections to addresses that are not Edges or known Arista infrastructure, and administrative or configuration changes with no corresponding change ticket.
6. If compromise is suspected, treat the Edges as in scope too. Review pushed configuration and business policy against a known-good revision, look for unexpected routing or traffic-steering rules, and rotate Orchestrator administrator credentials, API tokens and Edge certificates.
7. Review whether this host was also exposed to CVE-2026-16812 earlier in 2026, and extend the hunt window accordingly.
8. Federal civilian agencies were required to remediate by 2026-09-25 under BOD 26-04. For the 6.1 and 7.0 trains, where no patch was available, the directive's alternative is to apply mitigations or discontinue use of the product.