Full Report
Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22. The flaw, tracked as CVE-2026-93952, may allow a remote attacker with no login access to privilege internal functions and affect the VCO host. Only orchestrators set up to authenticate their Edges with certificates are
Analysis Summary
# Vulnerability: Critical Remote Privilege Escalation in Arista VeloCloud Orchestrator
## CVE Details
- **CVE ID:** CVE-2026-93952
- **CVSS Score:** 10.0 (Critical)
- **CWE:** Not explicitly stated (likely related to Improper Authentication or Privilege Escalation)
## Affected Systems
- **Products:** On-premises Arista VeloCloud Orchestrator (VCO)
- **Versions:**
- **5.2 Train:** 5.2.3.15 and earlier
- **6.1 Train:** 6.1.3.7 and earlier
- **6.4 Train:** 6.4.2.7 and earlier
- **7.0 Train:** 7.0.0.2 and earlier
- **Configurations:** Only orchestrators configured to authenticate Edge devices using certificates (Certificate Acquire or Certificate Required modes) are vulnerable.
## Vulnerability Description
CVE-2026-93952 is a critical flaw in the VeloCloud Orchestrator that allows a remote, unauthenticated attacker to privilege internal functions and potentially take full control of the VCO host. The vulnerability resides in how the server manages Edge devices via certificate-based authentication. A successful exploit grants access to the orchestrator’s managed data and can be used as a pivot point to access and control all managed Edge devices within the SD-WAN environment.
## Exploitation
- **Status:** **Exploited in the wild** (Active exploitation confirmed by Arista as of September 22, 2026).
- **Complexity:** Not explicitly stated, but requires network access to the VCO web interface and the public portion of an Edge's authentication certificate.
- **Attack Vector:** Network
## Impact
- **Confidentiality:** Critical (Total compromise of orchestrator data)
- **Integrity:** Critical (Ability to modify internal functions and configurations)
- **Availability:** Critical (Total control over the VCO host and managed Edge devices)
## Remediation
### Patches
Arista has released fixed versions for the following release trains:
- **5.2.3.16** and later
- **6.4.2.8** and later
*Note: Fixes for the 6.1 and 7.0 trains are pending as of the report date.*
### Workarounds
If upgrading is not immediately possible, implement the following:
- Restrict access to the VCO web interface to trusted administrative networks only.
- Block all unnecessary outbound ports from the VCO host.
- Monitor for unexpected outbound traffic and unauthorized administrator activity.
## Detection
### Indicators of Compromise (IoCs)
- **Malicious Files/Persistence:**
- `/usr/local/sbin/.vcnode.js`
- `/usr/local/sbin/vc-sysmond` (MD5: `dc78e206eaeadec59fc5801fe4556bd0`)
- `/etc/systemd/system/vc-sysmon.service`
- **Network Identifiers:**
- **IP Addresses:** `142.93.149[.]77`, `104.248.126[.]159`
- **HTTP Header:** Search nginx logs for `x-vc-opt`
- **Log Patterns:** Check web access logs for unusual URL-like paths, encoded characters, or high request rates targeting internal services.
## References
- **Vendor Advisory:** [hxxps://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183]
- **News Source:** [hxxps://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html]
- **Related Vulnerability:** CVE-2026-16812 (July 2024 flaw)