Arista VeloCloud Orchestrator On-Prem

CVE-2026-93952, Arista VeloCloud Orchestrator: actively exploited, two release trains still have no fix

CVE-2026-93952 (CVSS 3.1: 10.0, CVSS 4.0: 9.5, CWE-20 improper input validation) affects on-premises VeloCloud Orchestrator (VCO), the SD-WAN control-plane server that provisions and manages VeloCloud Edge devices. NCSC-NL classes the weakness as path traversal (NCSC-NL, 2026-09-22). Arista states the flaw "may allow a remote attacker to access privileged internal functionality and impact the VCO host," compromising confidentiality, integrity and availability of the orchestrator and the data it manages, and that a compromised VCO may in turn give an attacker access to the Edge devices it manages. Exposure is configuration-dependent: only VCOs with certificate-based Edge-to-VCO authentication configured are affected. "VCO is exposed if certificate based authentication from the VeloCloud Edge to VeloCloud Orchestrator (VCO) is configured. Access to the public portion of the VeloCloud Edge authentication certificate is required. A successful attack requires network access to the VCO web interface. VCO tenant or operator credentials are not required for this exposure" (Arista Networks, Security Advisory 0183, 2026-09-22). Affected release trains: 5.2 (5.2.3.15 and below), 6.1 (6.1.3.7 and below), 6.4 (6.4.2.7 and below), and 7.0 (7.0.0.2 and below). As of 2026-09-22, fixes exist only for the 5.2 release train (5.2.3.16+) and the 6.4 release train (6.4.2.8+); Arista states "releases in other release trains that fix this will be added over time" (Arista Networks, Security Advisory 0183, 2026-09-22), the 6.1.x and 7.0.x trains have no fix yet, with no committed date. Arista's Hosted and Dedicated VCO offerings were already patched. "This issue was discovered externally and is known to be actively exploited" (Arista Networks, Security Advisory 0183, 2026-09-22); Arista does not disclose when exploitation began or its scale. The affected release trains are the same ones Arista reported exploited via a separate, unrelated VCO command-injection flaw disclosed two months earlier: "the vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution" (The Hacker News, 2026-07-28, reporting on Arista Security Advisory 0144), that flaw was fixed across all four trains at the time (5.2.3.14+, 6.1.3.4+, 6.4.2.4+, 7.0.0.1+); this one leaves two open. VCO has now been targeted twice within roughly two months. CISA added CVE-2026-93952 to KEV the same day (CISA KEV, catalogue version 2026.09.22).

Triage: Arista flags outbound HTTP or HTTPS activity from the VCO host only when it is unexpected, and advises blocking outbound ports not needed for normal activity, so compare outbound connections with the orchestrator's known update and integration destinations rather than treating all outbound traffic as hostile (Arista Networks, Security Advisory 0183, 2026-09-22). A configuration or maintenance change with no matching administrator action is the other discriminator Arista names (Arista Networks, Security Advisory 0183, 2026-09-22).

CVE-2026-16812, Arista VeloCloud Orchestrator on-prem: unauthenticated OS command injection on an interface exposed by default, confirmed exploited (CVSS 10.0)

Arista disclosed CVE-2026-16812 on 2026-07-27: an improper-neutralisation flaw (CWE-78, OS command injection) in on-prem VeloCloud Orchestrator (VCO) that lets a remote attacker reach "privileged internal functionality" and act on the orchestrator host, scored 10.0 on both CVSS 3.1 and CVSS 4.0 (Arista, 2026-07-27). Two properties make this worse than the score alone suggests. First, there is no exploitation precondition to remove: Arista states the interface "is exposed by default", that "[t]here is no configuration that can prevent the exposure", and that tenant or operator credentials are not required; the only reachability control is network placement (Arista, 2026-07-27). Second, VCO is a management plane, not an edge device: Arista's own post-remediation guidance warns that "[c]ompromises to the VCO platform may allow attackers access to the VeloCloud Edge devices as well", so the blast radius is the managed SD-WAN fleet rather than one appliance (Arista, 2026-07-27).

Exploitation is not a projection. Arista states the issue "was discovered externally and is known to be actively exploited", and CISA added CVE-2026-16812 to the Known Exploited Vulnerabilities catalog on the day of disclosure (CISA, 2026-07-27). Affected are on-prem VCO 5.2.x before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4 and 7.0.x before 7.0.0.1; Arista's Resolution section enumerates fixed builds for the 5.2, 6.1 and 6.4 trains only, so 7.0.x operators should confirm their target release with the vendor rather than assume one. Hosted and Dedicated orchestrators were patched ahead of the advisory, and VeloCloud Gateway, VeloCloud Edge and the Arista EOS-based product lines are not in scope (Arista, 2026-07-27).

Detection, telemetry class first: the orchestrator's own web-access and reverse-proxy logs are the primary surface, Arista directs operators to requests carrying unusual URL-like path components, encoded characters or references to local or internal services, and to elevated request rates against the management interface. Pair that with backend application and system logs around the same timestamps for command execution, file creation, database export or archive artifacts that no administrator session accounts for, and with egress telemetry for outbound HTTP/HTTPS originating from the orchestrator host itself (Arista, 2026-07-27). The discriminator that carries the most weight here is directionality and provenance rather than payload shape: a management appliance legitimately receives administrative sessions and pushes configuration to its managed Edge devices, but it has little reason to originate arbitrary outbound web traffic, and configuration changes or privileged maintenance actions that correlate to no operator session are the anomaly Arista itself flags; the vendor states plainly that no single definitive indicator of compromise exists for this issue, so sequence and correlation carry the detection rather than any one artifact. Hardening is limited to what network placement can buy: Arista's interim control is restricting the web interface to trusted administrative networks, since the exposed functionality cannot be switched off in configuration.