NEWS

New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

Arista disclosed CVE-2026-93952, a CVSS 10.0 pre-auth privilege escalation in VeloCloud Orchestrator, already under active exploitation.

Dylan H.

News Desk

September 22, 2026
2 min read
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

Maximum-Severity Flaw Already Being Exploited

Attackers are actively exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO) — the management server behind VeloCloud's SD-WAN Edge devices — Arista disclosed on September 22, 2026. The vulnerability, tracked as CVE-2026-93952, carries a CVSS score of 10.0.

Vulnerability Summary

FieldDetails
CVE IDCVE-2026-93952
CVSS Score10.0 (Critical)
Vulnerability TypeRemote privilege escalation, no login required
Disclosed ByArista Networks
Exploitation StatusConfirmed active exploitation

Arista states the flaw "was discovered externally and is known to be actively exploited," and allows a remote attacker with no login access to privilege internal functions and affect the VCO host.

Affected Versions and Patches

BranchVulnerable VersionsPatch Status
5.25.2.3.15 and earlierFixed in 5.2.3.16+
6.16.1.3.7 and earlierNo patch yet
6.46.4.2.7 and earlierFixed in 6.4.2.8+
7.07.0.0.2 and earlierNo patch yet

Arista's Hosted and Dedicated VCO offerings have already been patched by the vendor directly.

Attack Requirements

Exploitation requires network access to the VCO web interface, plus the public part of an Edge device's authentication certificate. Only orchestrators configured for certificate-based Edge authentication are vulnerable — deployments using other authentication modes are not affected by this specific flaw.

Indicators of Compromise

Arista's guidance flags the following for defenders hunting active exploitation:

  • Suspicious outbound traffic to 142.93.149.77 and 104.248.126.159
  • Presence of .vcnode.js on the orchestrator filesystem
  • Unexpected vc-sysmond process activity
  • The x-vc-opt HTTP header appearing in web interface logs

Mitigation

  • Apply the patched release for your branch immediately (5.2.3.16+ / 6.4.2.8+); monitor for fixes on 6.1 and 7.0
  • Restrict VCO web interface access to trusted administrative networks only
  • Monitor for the IOCs above across web and system logs
  • If compromise is suspected: rotate credentials and consider orchestrator replacement per incident response procedures
  • Review whether certificate-based Edge authentication is required for your deployment, or whether an alternate auth mode can reduce exposure in the interim

Sources