Attackers are actively exploiting a new flaw in on-premises **VeloCloud Orchestrator (VCO)**, the server responsible for managing Edge devices in a **VeloCloud SD-WAN**. **Arista** confirmed the ongoing exploitation on September 22. The vulnerability, tracked as **CVE-2026-93952**, enables a remote attacker without login credentials to escalate privileges and affect the **VCO** host. This critical flaw exclusively impacts orchestrators configured to authenticate their Edges using certificates. As of September 22, **Arista** has released fixed versions for the 5.2 and 6.4 release trains. However, fixes for the 6.1 and 7.0 trains are not yet available. **Arista** has already patched its Hosted and Dedicated versions of **VCO**. Notably, this new vulnerability affects releases that had previously addressed a separate **VCO** flaw, **CVE-2026-16812**, which was also exploited in July. **Arista** has assigned **CVE-2026-93952** a **CVSS 3.1** score of 10.0, indicating its maximum severity. A successful exploit could lead to the complete compromise of the orchestrator and the sensitive data it manages. Furthermore, a compromised **VCO** could grant attackers access to the Edge devices under its control. **Arista** stated that the flaw "was discovered externally and is known to be actively exploited," though specific details regarding the commencement or widespread nature of these attacks were not provided. ### Which Deployments Are Exposed **VeloCloud** Edges can authenticate to the orchestrator via three modes: Certificate Deactivated, Certificate Acquire, and Certificate Required. **Arista** has clarified that an orchestrator is exposed if "certificate based authentication from the **VeloCloud Edge** to **VeloCloud Orchestrator (VCO)** is configured." Attackers also require network access to the **VCO** web interface and the public part of an Edge's authentication certificate. This contrasts with the July flaw, which did not depend on specific settings and exposed **VCO** by default without configuration-based prevention. ### Fixed Releases As of September 22, the following table details the affected releases, their corresponding fixes, and the releases that addressed the July flaw (**CVE-2026-16812**): | Train | Affected by **CVE-2026-93952** | Fixed in | July flaw (**CVE-2026-16812**) fixed in | |---|---|---|---| | 5.2 | 5.2.3.15 and earlier | 5.2.3.16 and later | 5.2.3.14 | | 6.1 | 6.1.3.7 and earlier | No fix yet | 6.1.3.4 | | 6.4 | 6.4.2.7 and earlier | 6.4.2.8 and later | 6.4.2.4 | | 7.0 | 7.0.0.2 and earlier | No fix yet | No fix listed. 7.0.0.1 and later were not affected. | **Arista** has committed to providing fixes for all affected, supported trains, and updates will be added to their security advisory. Customers on unsupported release trains are advised to contact **Arista's Technical Assistance Center (TAC)** for upgrade options. ### If You Cannot Upgrade Yet For organizations unable to upgrade immediately, **Arista** recommends the following interim measures: * Restrict access to the **VCO** web interface to only trusted administrative networks. * Actively monitor the **VCO** for access attempts from known malicious IP addresses. * Monitor for any unexpected outbound network traffic originating from the **VCO** host. * Consider blocking outbound ports not essential for normal operation. * Scan for the presence of backdoor daemons and webshells. * Regularly review recent administrator activity for any unauthorized or unexpected changes. ### Signs of Compromise While no single indicator definitively confirms compromise via this flaw, **Arista** advises checking **VCO** web access logs for unusual URL-like paths, encoded characters, references to local or internal services, or abnormally high request rates. Specific indicators to investigate include: * **File**: `/usr/local/sbin/.vcnode.js` * **File**: `/usr/local/sbin/vc-sysmond` * **MD5** (`vc-sysmond`): `dc78e206eaeadec59fc5801fe4556bd0` * **File**: `/etc/systemd/system/vc-sysmon.service` * **HTTP header** in nginx logs: `x-vc-opt` * **IP**: `142.93.149[.]77` * **IP**: `104.248.126[.]159` If any of these indicators are found, preserve the current state of the **VCO** and immediately contact **TAC** or your **Arista** account team. In cases of suspected compromise, it is crucial to save the **VCO**'s web access, backend application, system, and database logs, along with file-system timestamps, before attempting any remediation. Post-upgrade, **Arista** also recommends a comprehensive incident response. This should include rotating credentials, reviewing administrator activity, checking the state of managed Edge devices, and potentially restoring or replacing the orchestrator from trusted backups.