Arista Urges Immediate Patching of Exploited VCO Zero-Day

Arista Networks is urging customers to patch a maximum-severity, actively exploited zero-day in VeloCloud Orchestrator (VCO) On-Prem immediately, after confirming the flaw is already being used in real-world attacks against internet-facing deployments.

What Happened

Arista published Security Advisory 0183 disclosing CVE-2026-93952, an improper input validation flaw that lets a remote, unauthenticated attacker reach privileged internal functionality on a VCO host. Arista's own language leaves little room for ambiguity: "This issue was discovered externally and is known to be actively exploited." The company has already shipped fixed builds for two of the four affected release trains and is racing to finish patches for the rest.

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-93952 to its Known Exploited Vulnerabilities (KEV) catalog on September 22, 2026, triggering the three-day remediation clock under Binding Operational Directive 26-04 — federal civilian agencies running affected VCO instances must secure their networks by September 25.

What VCO Is — and Why This Matters

VCO stands for VeloCloud Orchestrator, the centralized management plane for Arista's VeloCloud SD-WAN product line (acquired from VMware). VCO is where administrators configure policy, monitor traffic, and push configuration out to every VeloCloud Edge appliance in an organization's network — meaning a single orchestrator instance typically has authority over dozens or hundreds of branch and data-center edges. Compromising the orchestrator doesn't just expose one device; it hands an attacker a management foothold over the entire SD-WAN fabric, including device inventory, configuration data, and certificate/key material. Arista's advisory treats a compromised VCO as a network-wide incident, not an isolated host issue.

Vulnerability Details

Exploitation requires certificate-based authentication configured between a VeloCloud Edge and the Orchestrator, network access to the VCO web interface, and possession of the public portion of a VeloCloud Edge authentication certificate — but no tenant or operator credentials are needed, and Arista rates the attack as low-complexity with no privileges or user interaction required. Arista-hosted and Dedicated VCO deployments have already been patched by Arista directly; on-prem operators must patch themselves.

Confirmed Exploitation and Attribution

Arista credits the discovery to an external party and states the flaw is under active exploitation, though it has not publicly named the researcher or attacker group. This is the second VCO zero-day exploited in the wild since July 2026 — the earlier CVE-2026-16812, an unauthenticated OS command injection flaw also scoring a maximum CVSS 10.0, was disclosed in late July and likewise landed on CISA's KEV list. Arista's advisory notes it has "no definitive compromise indicators" that apply universally, but publishes indicators observed in known intrusions, including:

• Files: /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond (MD5 dc78e206eaeadec59fc5801fe4556bd0), and a fake systemd unit at /etc/systemd/system/vc-sysmon.service
• A suspicious x-vc-opt HTTP header appearing in nginx access logs
• Outbound connections to 142.93.149.77 and 104.248.126.159

The presence of a disguised system service and hidden startup files suggests attackers are establishing persistence on compromised orchestrators, not simply exploiting and leaving.

Arista's Guidance

Arista's advisory recommends:

• Patch immediately to VCO 5.2.3.16+ or 6.4.2.8+; operators on the 6.1.x or 7.0.x trains should watch for the forthcoming fixes and apply them as soon as they ship
• Restrict VCO web interface access to trusted administrative networks only
• Review VCO web access logs, backend application logs, and system logs for suspicious activity — encoded characters in requests, unusual URL-like path components, references to internal services, or abnormally high request rates
• Hunt for the published indicators of compromise, including the specific files, service unit, HTTP header, and IP addresses listed above
• Review recent administrator activity for unexpected configuration changes, and watch for unusual database exports or archive file creation
• Block unnecessary outbound traffic from VCO hosts and monitor for unexpected external connections

Why This Matters

Arista's VeloCloud SD-WAN line sits at the network edge for a large base of enterprise and data-center customers, and the Orchestrator is a single point of administrative control over that entire footprint. A maximum-severity, pre-authentication flaw that's already being exploited — the second such VCO zero-day in three months — raises the stakes considerably for any organization running on-prem VCO with certificate-based Edge authentication. Combined with CISA's KEV listing and a hard federal patch deadline, this is squarely in immediate-action territory rather than routine patch-cycle work.

Sources

• Arista Urges Immediate Patching of Exploited VCO Zero-Day — SecurityWeek
• Arista patches actively exploited VeloCloud Orchestrator zero-day — BleepingComputer
• Security Advisory 0183 — Arista