Critical CVE-2026-93952 Confirmed as Actively Exploited
Arista disclosed on September 22 2026 that a remote-code-execution flaw in its on-premises VeloCloud Orchestrator (VCO) is being actively leveraged in the wild – the first time the vendor has observed live exploitation of a VCO vulnerability. The bug, cataloged as CVE-2026-93952, received a CVSS 3.1 score of 10.0, the maximum severity rating, because it permits an unauthenticated attacker to invoke privileged internal functions and potentially seize control of the orchestrator and every Edge device it manages. The VeloCloud Orchestrator CVE-2026-93952 details are also reflected in the NVD CVE records.
Attack Vector: Certificate-Based Edge Authentication
The vulnerability is gated by the authentication mode used between VCO and its managed Edge devices. VCO supports three modes:
- Certificate Deactivated – Edge authenticates with a pre-shared key (PSK).
- Certificate Acquire – Edge obtains a certificate from the orchestrator.
- Certificate Required – Edge must present a valid orchestrator-issued certificate. Arista states that any orchestrator configured for certificate-based authentication (Acquire or Required) is exposed. The attacker must also have network reachability to the VCO’s web interface and possession of the public portion of an Edge certificate. With those prerequisites, the exploit bypasses the orchestrator’s internal ACLs and executes arbitrary code in the VCO process space.
Affected Release Trains and Patch Landscape
Arista’s advisory lists the vulnerable releases and the corresponding fixed versions. The table below summarizes the state as of the advisory date:
| Train | Vulnerable up to | Fixed in | July-2026 flaw (CVE-2026-16812) fixed in |
|---|---|---|---|
| 5.2 | 5.2.3.15 and earlier | 5.2.3.16 and later | 5.2.3.14 |
| 6.1 | 6.1.3.7 and earlier | none yet | 6.1.3.4 |
| 6.4 | 6.4.2.7 and earlier | 6.4.2.8 and later | 6.4.2.4 |
| 7.0 | 7.0.0.2 and earlier | none yet | 7.0.0.1 and later not affected |
Patches for the supported 5.2 and 6.4 trains are already downloadable. Arista has indicated that fixes for the still-supported 6.1 and 7.0 trains are forthcoming, but no release dates have been announced. Customers on unsupported releases should open a TAC case to discuss upgrade paths.
Immediate Mitigation Steps When Patching Is Not Possible
While waiting for official patches, Arista recommends a hardened operational posture:
- Network Segmentation – Limit VCO web UI access to dedicated admin subnets; block internet-facing exposure.
- IP Reputation Filtering – Block known malicious sources such as
142.93.149[.]77and104.248.126[.]159that appear in the IOC list. - Outbound Port Hardening – Close any non-essential outbound ports on the VCO host to reduce exfiltration channels.
- Process and File Integrity Monitoring – Watch for creation of
/usr/local/sbin/.vcnode.js,/usr/local/sbin/vc-sysmond, and the systemd unitvc-sysmon.service. - Log-Based Threat Hunting – Scrutinize Nginx access logs for unusual URL-encoded paths, high request rates, or the custom header
x-vc-opt. These controls do not eliminate the underlying code flaw but raise the bar for an attacker to reach the vulnerable code path.
Indicators of Compromise (IOCs) Provided by Arista
Arista supplies a concise IOC set that can be fed into SIEM rules:
- Files:
/usr/local/sbin/.vcnode.js,/usr/local/sbin/vc-sysmond - MD5 of
vc-sysmond:dc78e206eaeadec59fc5801fe4556bd0 - Systemd service:
/etc/systemd/system/vc-sysmon.service - HTTP header:
x-vc-opt - Malicious IPs:
142.93.149[.]77,104.248.126[.]159Detection of any of these artifacts should trigger immediate containment, forensic capture of VCO logs, and escalation to Arista TAC.
Post-Compromise Response Checklist
If evidence of compromise surfaces, Arista advises a structured response:
- Preserve Volatile Data – Capture memory dumps, active network sockets, and running process lists before remediation.
- Log Retention – Export web access, backend application, and database logs with timestamps intact.
- Credential Rotation – Reset all VCO admin credentials and any certificates used for Edge authentication.
- Edge Device Audit – Verify the integrity of each managed Edge; re-provision any that show signs of tampering.
- Orchestrator Re-deployment – When possible, rebuild the VCO from a clean, trusted image and apply the latest patches.
Broader Implications for SD-WAN Deployments
The VCO flaw underscores a systemic risk in SD-WAN architectures that rely on a single point of control for a fleet of distributed edges. Certificate-based authentication, while improving security over PSKs, creates a trusted-certificate surface that, if compromised, grants attackers a foothold across the entire network fabric. Enterprises should therefore consider zero-trust segmentation between the orchestrator and edge data planes, and evaluate mutual TLS with strict certificate pinning to limit the attack surface.
Regulatory and Compliance Angle
A breach of an SD-WAN orchestrator can expose traffic metadata, configuration secrets, and potentially customer data traversing the network. For organizations subject to PCI-DSS, HIPAA, or GDPR, a successful VCO compromise may trigger breach notification obligations. The CVSS 10.0 rating also aligns with many CISA high-impact alerts, suggesting that affected entities should treat this as a critical vulnerability in their risk registers.
External References
Additional context on similar high-severity SD-WAN bugs can be found in the Cisco 0-Day Vulnerability Exposes Users to Remote Exploitation analysis.
What to Watch Next
Arista has pledged to publish patches for the remaining trains within the next few weeks. Security teams should monitor Arista Security Advisories and CISA Alerts for update notifications. Moreover, threat-intel feeds are already flagging activity from a previously unknown actor that appears to be scanning for vulnerable VCO instances on the public internet. Early detection of scanning traffic—especially to the VCO’s default port 443—will be a valuable early-warning signal.
CVE-2026-93952 is a critical, actively exploited flaw that targets certificate-authenticated VeloCloud Orchestrator deployments. Immediate patching of the 5.2 and 6.4 trains, strict network segmentation, and vigilant IOC hunting are essential to prevent a full-scale SD-WAN compromise.
Related coverage
- Orkes Conductor CVE-2026-58138: Critical Pre-Auth RCE Actively Exploited
- Linux Kernel Vulnerability Gives ARM64 KVM Guests Read-Write Access to Host Memory
- Google Gemini AI Model Breach: A Case Study