Maximum-Severity Flaw Already Being Exploited
Attackers are actively exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO) — the management server behind VeloCloud's SD-WAN Edge devices — Arista disclosed on September 22, 2026. The vulnerability, tracked as CVE-2026-93952, carries a CVSS score of 10.0.
Vulnerability Summary
| Field | Details |
|---|---|
| CVE ID | CVE-2026-93952 |
| CVSS Score | 10.0 (Critical) |
| Vulnerability Type | Remote privilege escalation, no login required |
| Disclosed By | Arista Networks |
| Exploitation Status | Confirmed active exploitation |
Arista states the flaw "was discovered externally and is known to be actively exploited," and allows a remote attacker with no login access to privilege internal functions and affect the VCO host.
Affected Versions and Patches
| Branch | Vulnerable Versions | Patch Status |
|---|---|---|
| 5.2 | 5.2.3.15 and earlier | Fixed in 5.2.3.16+ |
| 6.1 | 6.1.3.7 and earlier | No patch yet |
| 6.4 | 6.4.2.7 and earlier | Fixed in 6.4.2.8+ |
| 7.0 | 7.0.0.2 and earlier | No patch yet |
Arista's Hosted and Dedicated VCO offerings have already been patched by the vendor directly.
Attack Requirements
Exploitation requires network access to the VCO web interface, plus the public part of an Edge device's authentication certificate. Only orchestrators configured for certificate-based Edge authentication are vulnerable — deployments using other authentication modes are not affected by this specific flaw.
Indicators of Compromise
Arista's guidance flags the following for defenders hunting active exploitation:
- Suspicious outbound traffic to
142.93.149.77and104.248.126.159 - Presence of
.vcnode.json the orchestrator filesystem - Unexpected
vc-sysmondprocess activity - The
x-vc-optHTTP header appearing in web interface logs
Mitigation
- Apply the patched release for your branch immediately (5.2.3.16+ / 6.4.2.8+); monitor for fixes on 6.1 and 7.0
- Restrict VCO web interface access to trusted administrative networks only
- Monitor for the IOCs above across web and system logs
- If compromise is suspected: rotate credentials and consider orchestrator replacement per incident response procedures
- Review whether certificate-based Edge authentication is required for your deployment, or whether an alternate auth mode can reduce exposure in the interim