Attackers are exploiting CVE-2026-93952 in VeloCloud Orchestrators that authenticate Edges by certificate

Arista said on September 22 that attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN.

Arista said the flaw "was discovered externally and is known to be actively exploited."

Only orchestrators set up to authenticate their Edges with certificates are exposed.

The flaw is tracked as CVE-2026-93952 and may allow a remote attacker with no login access to privilege internal functions and affect the VCO host.

Arista gave the flaw a CVSS 3.1 score of 10.0.

Arista said fixes for affected trains that are still supported are coming and will be added to its advisory when ready, and that customers on an unsupported release train can contact Arista's Technical Assistance Center about upgrade options.

A successful attack may compromise the orchestrator and the data it manages, and a compromised VCO may also give attackers access to the Edge devices it manages.

Until a fixed release is installed, Arista recommends limiting access to the VCO web interface to trusted administrative networks, monitoring the VCO for access from known malicious IP addresses, monitoring for unexpected outbound traffic from the VCO host, considering blocking outbound ports not required for normal operation, monitoring for backdoor daemons and webshells, and reviewing recent administrator activity for unexpected changes.

Arista said no single indicator proves that a VCO was compromised through this flaw, and advised checking VCO web access logs for requests with unusual URL-like paths, encoded characters, references to local or internal services, or high request rates.

The specific indicators Arista listed are the files /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond (MD5 dc78e206eaeadec59fc5801fe4556bd0) and /etc/systemd/system/vc-sysmon.service, the HTTP header x-vc-opt in nginx logs, and the IP addresses 142.93.149[.]77 and 104.248.126[.]159.

Arista said that if any indicator is found, customers should preserve the state of the VCO and contact TAC or their Arista account team, and that anyone suspecting compromise should save the VCO's web access, backend application, system and database logs and its file-system timestamps before fixing anything, where that is practical.

Arista advises incident response after upgrading, which may include rotating credentials, reviewing administrator activity, checking the state of managed Edge devices, and restoring or replacing the orchestrator from trusted sources.

Arista did not say which of the three authentication modes meets its exposure condition, and did not say when the attacks began or how widespread they are.

Arista has already patched the Hosted and Dedicated versions of VCO.

The affected releases include those that fixed a different VCO flaw, which Arista reported as exploited in July.

The Hacker News said it has contacted Arista for comment.

Of the four on-premises release trains named in the advisory, two (5.2 and 6.4) have fixed releases and two (6.1 and 7.0) do not, as of September 22.

VeloCloud Edges can authenticate to the orchestrator in one of three modes: Certificate Deactivated, in which the Edge uses a pre-shared key, and Certificate Acquire and Certificate Required, in which it uses a certificate issued by the orchestrator.

Three of the seven indicators Arista published are files on the VCO host; the others are a file hash, an HTTP header in nginx logs, and two IP addresses.

The July flaw did not depend on settings: VCO was exposed to it by default, and no configuration could prevent that.

An operator who upgraded in July to a release that fixed the earlier exploited VCO flaw is running a release affected by CVE-2026-93952.