CVE-2026-93952, Arista VeloCloud Orchestrator: actively exploited, two release trains still have no fix
Arista confirms exploitation of an SD-WAN orchestrator flaw that has no patch for two of its four release trains
Defender actions
- Upgrade every on-prem VeloCloud Orchestrator on the 5.2.x or 6.4.x train to 5.2.3.16+ / 6.4.2.8+ now.
- On the unpatched 6.1.x/7.0.x trains, restrict VCO web-interface access to trusted administrative networks now; no fix exists yet.
Analysis
CVE-2026-93952 (CVSS 3.1: 10.0, CVSS 4.0: 9.5, CWE-20 improper input validation) affects on-premises VeloCloud Orchestrator (VCO), the SD-WAN control-plane server that provisions and manages VeloCloud Edge devices. NCSC-NL classes the weakness as path traversal (NCSC-NL, 2026-09-22). Arista states the flaw "may allow a remote attacker to access privileged internal functionality and impact the VCO host," compromising confidentiality, integrity and availability of the orchestrator and the data it manages, and that a compromised VCO may in turn give an attacker access to the Edge devices it manages. Exposure is configuration-dependent: Arista lists the affected releases by version alone, but only VCOs with certificate-based Edge-to-VCO authentication configured are exposed. "VCO is exposed if certificate based authentication from the VeloCloud Edge to VeloCloud Orchestrator (VCO) is configured. Access to the public portion of the VeloCloud Edge authentication certificate is required. A successful attack requires network access to the VCO web interface. VCO tenant or operator credentials are not required for this exposure" (Arista Networks, Security Advisory 0183, 2026-09-22). Affected release trains: 5.2 (5.2.3.15 and below), 6.1 (6.1.3.7 and below), 6.4 (6.4.2.7 and below), and 7.0 (7.0.0.2 and below). As of 2026-09-22, fixes exist only for the 5.2 release train (5.2.3.16+) and the 6.4 release train (6.4.2.8+); Arista states "releases in other release trains that fix this will be added over time" (Arista Networks, Security Advisory 0183, 2026-09-22); the 6.1.x and 7.0.x trains have no fix yet, with no committed date. Arista's Hosted and Dedicated VCO offerings were already patched. "This issue was discovered externally and is known to be actively exploited" (Arista Networks, Security Advisory 0183, 2026-09-22); Arista does not disclose when exploitation began or its scale. The affected release trains are the same ones Arista reported exploited via a separate VCO command-injection flaw disclosed two months earlier: "the vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution" (The Hacker News, 2026-07-28, reporting on Arista Security Advisory 0144); that flaw was fixed across all four trains at the time (5.2.3.14+, 6.1.3.4+, 6.4.2.4+, 7.0.0.1+); this one leaves two open. VCO has now been targeted twice within roughly two months. CISA added CVE-2026-93952 to KEV the same day (CISA KEV, catalogue version 2026.09.22).
Triage: Arista flags outbound HTTP or HTTPS activity from the VCO host only when it is unexpected, and advises blocking outbound ports not needed for normal activity, so compare outbound connections with the orchestrator's known update and integration destinations rather than treating all outbound traffic as hostile (Arista Networks, Security Advisory 0183, 2026-09-22). A configuration or maintenance change with no matching administrator action is the other discriminator Arista names (Arista Networks, Security Advisory 0183, 2026-09-22).
Cited evidence
This issue was discovered externally and is known to be actively exploited.
VCO is exposed if certificate based authentication from the VeloCloud Edge to VeloCloud Orchestrator (VCO) is configured. Access to the public portion of the VeloCloud Edge authentication certificate is required. A successful attack requires network access to the VCO web interface. VCO tenant or operator credentials are not required for this exposure.
Releases in other release trains that fix this will be added over time.
Updates2
Arista's advisory does not name an authentication-mode change as a mitigation. Its interim controls are restricting web-interface access to trusted administrative networks, monitoring for unexpected outbound traffic, backdoor daemons and webshells, blocking outbound ports not needed for normal activity, and reviewing administrator activity (Arista Networks, Security Advisory 0183, 2026-09-22). Arista also does not say which certificate modes meet its exposure condition (The Hacker News, 2026-09-22), so switching Edge authentication to PSK mode is an untested option rather than a vendor control. Some outbound traffic from the orchestrator is normal, and Arista flags only unexpected outbound activity (Arista Networks, Security Advisory 0183, 2026-09-22). As of 2026-09-30 the advisory still lists no fix for the 6.1 and 7.0 trains (Arista Networks, Security Advisory 0183, 2026-09-22).
Arista lists the affected releases by version alone; certificate-based authentication from the VeloCloud Edge to the orchestrator is its "Required Configuration for Exploitation", the condition under which an affected VCO is exposed, not a limit on which releases are affected (Arista Networks, Security Advisory 0183, 2026-09-22). The flaw Arista reported exploited in July is described only as a different VCO flaw (The Hacker News, 2026-09-22); no source says whether the two are related. As of 2026-10-21 the advisory still lists fixed releases only for the 5.2 and 6.4 trains (Arista Networks, Security Advisory 0183, 2026-09-22).
Sources5
Revision history
- Published 2026-09-23T0405Z-intel
- Correction 2026-09-30T0639Z-audit
The detection guidance carried no citation although it comes from Arista's advisory, which also lists behavioral compromise artifacts the entry omitted. The Detection line now cites Arista and describes the backdoor's persistence behavior and log artifact without indicator values, and the Triage line is tightened to what that guidance supports. The immediate action and takeaway no longer present a switch to PSK Edge authentication as a vendor control, since Arista names none and does not say which certificate modes are exposed, and they now carry Arista's own interim controls. The triage line no longer claims an orchestrator never makes outbound web connections, the artifact description keeps to what Arista lists, and the detection, triage and takeaway lines are separated. The default-config tag is removed, since Arista says only orchestrators with certificate-based Edge authentication configured are exposed.
Changed: body immediate_action tags cves
- Improvement 2026-10-21T0800Z-audit
Certificate-based Edge authentication is Arista's condition for an affected orchestrator to be exposed, not a limit on the affected releases, which Arista lists by version alone; the analysis and the affected-version record now keep the two apart. The July VCO flaw is no longer called unrelated, which no source says, and as of 2026-10-21 Arista still lists fixes only for the 5.2 and 6.4 trains.
Changed: actions body cves immediate_action summary title
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.