Active Attacks Target Certificate-Enabled VeloCloud Orchestrator Servers

Arista disclosed on September 22, 2026, that attackers are exploiting a critical vulnerability in on-premises VeloCloud Orchestrator deployments. The management platform controls VeloCloud SD-WAN Edge devices, making a compromised orchestrator a potential entry point into the broader managed network.

The vulnerability, tracked as CVE-2026-93952, carries a CVSS 3.1 score of 10.0. It allows a remote, unauthenticated attacker to access privileged internal functionality and potentially compromise the VCO host.

Exploitation is not universal across all VCO configurations. The reported attack path requires certificate-based authentication between Edge devices and the orchestrator, network access to the VCO web interface, and the public component of an Edge authentication certificate.

Exposure Depends on the Edge Authentication Configuration

VeloCloud Edge devices can authenticate to VCO using three modes:

• Certificate Deactivated, which relies on a pre-shared key.
• Certificate Acquire, which uses a certificate issued by the orchestrator.
• Certificate Required, which also uses an orchestrator-issued certificate.

Arista identified certificate-based Edge authentication as an exposure condition. It has not been disclosed whether CVE-2026-93952 affects Certificate Acquire, Certificate Required, or both modes.

An attacker must also be able to reach the VCO web interface and possess the public portion of an Edge authentication certificate. No attacker authentication is required once those conditions are met.

The vulnerability’s CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This reflects a network-accessible issue requiring low attack complexity, without privileges or user interaction, and with potentially severe effects across confidentiality, integrity, and availability.

The precise software flaw enabling the attack has not been publicly described. No CWE classification is available, and Arista has not detailed the requests, internal component, or processing error involved. The company said the vulnerability was discovered externally and is already being exploited, but did not say when attacks began or how many systems or organizations have been compromised.

Hosted and Dedicated VCO instances were patched before the public disclosure. The remaining exposure therefore centers on customer-managed, on-premises installations.

Fixed Releases Are Available for Only Two Trains

The affected and corrected versions reported on September 22 are:

Release train	Affected versions	Fixed release
5.2	5.2.3.15 and earlier	5.2.3.16 and later
6.1	6.1.3.7 and earlier	No fix available
6.4	6.4.2.7 and earlier	6.4.2.8 and later
7.0	7.0.0.2 and earlier	No fix available

Organizations on the 5.2 train should upgrade to 5.2.3.16 or a later release. Those using 6.4 should install 6.4.2.8 or later.

No corrected version had been released for the affected 6.1 and 7.0 trains at the time of reporting. Arista said updates for affected trains that remain supported would be added to its advisory when available.

Customers operating an unsupported release train should contact Arista’s Technical Assistance Center to discuss an upgrade path. Operators of 6.1 and 7.0 systems should also monitor the vendor’s guidance rather than assuming that configuration changes alone eliminate the risk.

Orchestrator Compromise Can Extend to Managed Edge Devices

VCO is the management server for VeloCloud SD-WAN Edge infrastructure. Successful exploitation may therefore affect more than the host running the orchestrator.

The immediate consequences include unauthorized access to privileged internal functions and possible compromise of the confidentiality, integrity, and availability of VCO and its managed data. Because the server administers Edge devices, an attacker controlling VCO may also gain a route to change or otherwise interfere with the managed Edge estate.

Possible post-compromise behavior includes unauthorized administrative changes, webshell deployment, installation of persistent daemons, and unexpected outbound communications from the VCO server. Attackers could also manipulate Edge configurations through the compromised management layer.

These activities are potential consequences and detection targets, not confirmation that every compromised system will contain the same artifacts. Arista cautioned that no single published indicator conclusively establishes exploitation through CVE-2026-93952.

Defenders Should Hunt for Host Artifacts and Abnormal Web Requests

Administrators should begin by examining VCO web-access logs. Suspicious patterns include unusual URL-style paths, encoded characters, references to internal or local services, and request volumes that differ sharply from normal management activity.

The disclosed indicators are:

Type	Indicator
File	/usr/local/sbin/.vcnode.js
File	/usr/local/sbin/vc-sysmond
MD5 for vc-sysmond	dc78e206eaeadec59fc5801fe4556bd0
Systemd unit	/etc/systemd/system/vc-sysmon.service
Nginx log HTTP header	x-vc-opt
IP address	142.93.149[.]77
IP address	104.248.126[.]159

Detection should not stop with this list. Security teams should check for newly created or modified services, webshell-like files, unexplained administrator actions, and outbound traffic that does not match the orchestrator’s expected behavior.

Connections involving the two disclosed IP addresses deserve investigation, but an address match alone does not prove exploitation. The same caution applies to abnormal requests and isolated file artifacts.

If indicators or suspicious activity are found, administrators should preserve the system’s current state before remediation changes the available evidence. Useful evidence includes web-access, backend-application, system, and database logs, along with file-system timestamps.

Arista recommends contacting TAC or the organization’s Arista account team after identifying potential compromise.

Patch, Restrict Access, and Treat Suspicious Hosts as Compromised

Installing a fixed release is the primary action where one is available. Until that can be completed, operators should restrict access to the VCO web interface so that it is reachable only from trusted administrative networks.

Additional defensive measures include:

1. Monitoring for traffic involving the disclosed malicious IP addresses.
2. Investigating unexpected outbound connections from the VCO host.
3. Blocking unnecessary outbound ports where operational requirements permit.
4. Searching for unauthorized daemons, altered services, and webshells.
5. Reviewing recent administrator activity and configuration changes.
6. Validating the condition and configuration of managed Edge devices.

After upgrading a potentially exposed system, organizations should rotate credentials, inspect administrator activity, and verify that managed Edge devices have not been altered. Where compromise is suspected, restoring or replacing the orchestrator from trusted sources is safer than treating the update as sufficient remediation.

A host showing indicators, anomalous management actions, or suspicious network activity should be handled as potentially compromised, not merely vulnerable.

A Second Critical VCO Flaw Follows an Earlier KEV Case

CVE-2026-93952 follows another critical VeloCloud Orchestrator vulnerability, CVE-2026-16812, reported in July. That earlier issue also received a CVSS score of 10.0 and was classified as CWE-78.

Its exposure model was different. CVE-2026-16812 was reported as exploitable under the default configuration and could not be prevented through configuration settings, whereas the newly disclosed issue depends on certificate-based Edge authentication and web-interface reachability.

CISA added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog on July 27, 2026, with a remediation deadline of July 30, 2026, for U.S. federal agencies. The required action was to apply vendor mitigations while following BOD 26-04 risk-based update guidance and CISA’s forensic triage requirements. Where mitigations were unavailable, applicable guidance called for discontinuing use.

No CISA KEV entry has been disclosed for CVE-2026-93952. Its confirmed active exploitation nevertheless makes patching, exposure reduction, and compromise assessment immediate priorities for operators of certificate-enabled on-premises VCO systems.