Maxed-Out VeloCloud Orchestrator Flaw Already Under Active Attack

On September 22, Arista disclosed active exploitation of a new flaw in the on-premises VeloCloud Orchestrator (VCO) — the server that manages the Edge devices in a VeloCloud SD-WAN.

The vulnerability, tracked as CVE-2026-93952, lets a remote attacker with no login access reach internal functions and affect the VCO host itself. Arista rated it 10.0 under CVSS 3.1 — the maximum. A successful attack can compromise the orchestrator and the data it manages, and a compromised VCO can in turn hand attackers access to the Edge devices it oversees.

Who is exposed

Only orchestrators that authenticate their Edges with certificates are affected. VeloCloud supports three authentication modes: with certificates deactivated an Edge uses a pre-shared key, while in Acquire and Required modes it uses a certificate issued by the orchestrator. Beyond the configuration, an attacker also needs network access to the VCO web interface and the public part of an Edge's authentication certificate.

Arista said the flaw "was discovered externally and is known to be actively exploited," but did not say when the attacks began or how widespread they are. Notably, the affected builds include those that had fixed a different VCO flaw Arista reported as exploited back in July (CVE-2026-16812) — one that, unlike this one, was dangerous by default, with no configuration able to prevent it.

Fixes and mitigations

As of September 22, fixed releases are out for the 5.2 and 6.4 trains but not yet for 6.1 and 7.0. Arista has already patched the Hosted and Dedicated versions of VCO. Customers on unsupported trains are told to contact TAC about upgrade options.

Until a fix is installed, Arista recommends limiting access to the VCO web interface to trusted administrative networks, watching for access from known malicious IPs and for unexpected outbound traffic, blocking unneeded outbound ports, and hunting for backdoor daemons and webshells.

Signs of compromise

No single indicator is conclusive, but web access logs are worth checking for requests with unusual paths, encoded characters, or high request rates. Specific markers include the files /usr/local/sbin/.vcnode.js, vc-sysmond (MD5 dc78e206eaeadec59fc5801fe4556bd0) and vc-sysmon.service, the x-vc-opt HTTP header in nginx logs, and the IPs 142.93.149.77 and 104.248.126.159. If any turn up, Arista advises preserving the system state and logs and contacting TAC — and, after upgrading, running incident response that includes rotating credentials and checking managed Edge devices.

Source: The Hacker News