Arista Networks disclosed on September 22, 2026, that attackers are exploiting CVE-2026-93952, a CVSS 10.0 flaw in on-premises VeloCloud Orchestrator that needs no tenant or operator credentials. Fixes exist for only two of the four affected release trains.
What to Know?
- Arista confirms attackers exploited CVE-2026-93952 as a zero-day and also scores it 9.5 under the newer CVSS v4.0 system.
- VeloCloud Orchestrator On-Prem builds 5.2.3.16 and 6.4.2.8 carry the fix, while the 6.1.x and 7.0.x trains still lack one.
- Attackers need the public half of an Edge authentication certificate and network access to the VCO web interface, but no login.
- The advisory names three planted files, one malware hash and two attacker IP addresses that defenders can hunt for.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal agencies three days to patch.
How It Happened?
VeloCloud Orchestrator (VCO) is the central console for Arista VeloCloud SD-WAN, where administrators configure, monitor and orchestrate edge devices, policies and traffic. Arista Networks, the cloud networking vendor, took the product over from Broadcom, so older documentation still calls it VeloCloud Orchestrator by Broadcom.
The bug is an improper input validation weakness (CWE-20). According to Arista’s Security Advisory 0183, it may let a remote attacker “access privileged internal functionality and impact the VCO host,” putting the orchestrator and the data it manages at risk. “This issue was discovered externally and is known to be actively exploited,” the company said.
Exposure depends on one setting: certificate-based authentication from VeloCloud Edge devices to VCO. With it enabled, an attacker needs the public portion of an Edge authentication certificate plus network reach to the VCO web interface, and nothing else. Public certificate material isn’t built to stay secret, so that prerequisite does little on its own to slow a determined attacker.
Which Builds Are Exposed?
Arista’s advisory lists four vulnerable trains. Hosted and Dedicated VCO instances were affected as well, but Arista says it has already patched those.
| Release train | Vulnerable builds | Fixed build |
|---|---|---|
| 5.2.x | 5.2.3.15 and below | 5.2.3.16 and later |
| 6.1.x | 6.1.3.7 and below | No fix listed yet |
| 6.4.x | 6.4.2.7 and below | 6.4.2.8 and later |
| 7.0.x | 7.0.0.2 and below | No fix listed yet |
Operators on 6.1.x should read the table closely. Build 6.4.2.8 belongs to the 6.4.2 train, so it isn’t a drop-in fix for a 6.1 deployment, and the newer 7.0.x line has no patched release either. Arista says fixes for its other supported trains will follow.
What Defenders Should Look For?
Arista states that “there is no single definitive indicator of compromise for this issue,” yet the advisory still hands responders concrete leads:
- A hidden file at /usr/local/sbin/.vcnode.js.
- A file at /usr/local/sbin/vc-sysmond with the known malicious MD5 hash dc78e206eaeadec59fc5801fe4556bd0.
- A service file at /etc/systemd/system/vc-sysmon.service.
- The HTTP header x-vc-opt in nginx logs.
- Connections from 142.93.149.77 or 104.248.126.159.
Those names resemble ordinary VeloCloud system components, which means a quick scan of running services may not flag them. Arista’s own caveat also means a clean result proves little, because the list reflects known activity rather than every variant. Arista asks teams to review VCO web access logs for unusual URL paths, encoded characters or high request rates, and to check backend and system logs for unauthorized configuration changes or unexpected command execution.
Until a fix is in place, the company recommends restricting the VCO web interface to trusted administrative networks, watching for unexpected outbound traffic from VCO hosts and reviewing administrator activity. Deployments that already limit web access carry lower risk, though Arista still wants everyone on a fixed release.
Why It Matters?
An orchestrator holds the configuration for every edge it manages, so an attacker on the VCO host sits above the whole SD-WAN. This flaw asks for no stolen password, only certificate material an edge presents in normal operation and a reachable web portal. Network infrastructure software keeps drawing zero-day attacks, as the Cisco IOS SNMP zero-day showed last year.
What’s next is a short clock: CISA’s Known Exploited Vulnerabilities catalog listing gives federal agencies until Friday under BOD 26-04, and Arista still hasn’t said when 6.1.x and 7.0.x fixes will ship, how many on-prem customers were hit or who is behind the attacks. Teams on those two trains should lock down VCO web access now, hunt for the listed files and IP addresses, and treat any match as a compromised host that needs incident response. Patching alone helps reduce risk going forward but won’t remove an attacker who is already inside.
