New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

1. Executive summary

Arista disclosed on 22 September 2026 that a new flaw in on-premises VeloCloud Orchestrator (VCO), CVE-2026-93952, is under active exploitation. The verified reference data records CVE-2026-93952 as CVSS 9.5 CRITICAL, CWE-20 (Improper Input Validation), and not listed in CISA KEV; the vendor's own advisory quotes CVSS 3.1 10.0, and we note that discrepancy rather than resolve it. Exposure is conditional: only orchestrators configured for certificate-based authentication from VeloCloud Edge to VCO are affected, unlike the July 2026 VCO flaw (CVE-2026-16812) which was exposed by default. A successful attack compromises the orchestrator host and the data it manages, and can extend attacker access to the managed Edge devices. Fixed releases exist for the 5.2 and 6.4 trains as of disclosure date; the 6.1 and 7.0 trains have no fix yet, which leaves a live exposure window for financial services firms running those trains.

2. Regulatory framing

No NIS2 or UK NIS article is engaged beyond generic incident-handling duties; the item's facts do not trigger a distinctive obligation under the supplied reference.

3. Technical analysis & attack chain

CVE-2026-93952 affects on-premises VeloCloud Orchestrator, the server that centrally manages VeloCloud Edge devices in an SD-WAN. The verified reference data classifies it as CWE-20, improper input validation; the vendor advisory describes the impact as allowing a remote attacker with no login access to reach privileged internal functions and affect the VCO host. Both descriptions fit the same flaw: unvalidated input reaching internal privileged functionality.

Exposure conditions, per Arista:

1. The orchestrator must have certificate-based authentication from VeloCloud Edge to VCO configured. VeloCloud Edges authenticate in three modes: Certificate Deactivated (Edge uses a pre-shared key), Certificate Acquire, and Certificate Required (both use a certificate issued by the orchestrator). Arista did not specify which of the certificate modes meets the exposure condition.
2. The attacker needs network access to the VCO web interface.
3. The attacker needs the public part of an Edge's authentication certificate.

This contrasts with the July 2026 flaw in the same product, CVE-2026-16812 (CVSS 10.0, OS command injection, added to CISA KEV with a 2026-07-30 due date): that flaw exposed VCO by default with no configuration able to remove the exposure. CVE-2026-93952 affects releases that include the fix for the July flaw, so patching for CVE-2026-16812 does not protect against this one.

Confirmed attack chain, as far as the sources support:

1. Attacker obtains the public part of an Edge authentication certificate.
2. Attacker reaches the VCO web interface over the network, unauthenticated.
3. Exploitation of CVE-2026-93952 lets the attacker reach privileged internal functions and affect the VCO host.
4. Successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.
5. A compromised VCO may give the attacker access to the Edge devices it manages.

The sources do not describe the post-compromise payload, persistence mechanism, command-and-control, or data exfiltration in a chain. Arista's compromise indicators (below) point to a backdoor daemon and webshell on the VCO host, which implies host-level code execution and persistence, but the mechanism is not documented. Arista said the flaw "was discovered externally and is known to be actively exploited" but did not say when attacks began or how widespread they are. No threat actor is named in any source, so no attribution assessment is possible; treat any attribution claim as unconfirmed.

Fixed and affected releases as of 22 September 2026: fixes are out for the 5.2 and 6.4 release trains; the 6.1 and 7.0 trains have no fix yet, with Arista stating fixes for still-supported affected trains are coming and will be added to its advisory. Arista has already patched its Hosted and Dedicated VCO services. Customers on unsupported trains can contact Arista TAC about upgrade options. The source article did not enumerate the specific affected version numbers per train.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every on-premises VCO and record its release train and Edge authentication mode (Certificate Deactivated, Certificate Acquire, Certificate Required). Any VCO on the 5.2 or 6.4 train with certificate-based Edge authentication is patchable now: upgrade to the fixed release for that train from Arista's advisory.
• For VCOs on the 6.1 or 7.0 trains with certificate-based Edge authentication, apply Arista's interim guidance immediately: restrict VCO web interface access to trusted administrative networks, and block the two attacker IP addresses Arista published (see §5) at the perimeter.
• Hunt for the compromise indicators in §5 on every in-scope VCO before and after patching. If any indicator is present, preserve the VCO state and contact Arista TAC or your account team before remediation; save web access, backend application, system and database logs and file-system timestamps where practical.

P2, within 72 hours:

• Monitor the VCO for access from known malicious IP addresses and for unexpected outbound network traffic from the VCO host. Block outbound ports not required for normal operation.
• Review recent administrator activity on the VCO for unexpected changes.
• Monitor for backdoor daemons and webshells, specifically the file paths in §5.
• Check VCO web access logs for the patterns Arista flags: unusual URL-like paths, encoded characters, references to local or internal services, high request rates, and the x-vc-opt HTTP header in nginx logs. Arista states no single indicator proves compromise through this flaw.

P3, within 7 days:

• Track Arista's advisory for fixed releases on the 6.1 and 7.0 trains and upgrade as soon as they publish. Escalate through your Arista relationship if your firm runs those trains.
• After upgrading, run Arista's advised incident response: rotate credentials, review administrator activity, check the state of managed Edge devices, and restore or replace the orchestrator from trusted sources.
• Confirm whether any VCO was exposed to the July CVE-2026-16812 (KEV, due date 2026-07-30) and remediated then; the affected releases for this flaw include those that fixed the July flaw, so prior patching is not evidence of safety.

5. Indicators of compromise

All indicators below are single-sourced from Arista's advisory as reported by The Hacker News; verify before enforcement.

file  /usr/local/sbin/.vcnode.js
file  /usr/local/sbin/vc-sysmond
md5  dc78e206eaeadec59fc5801fe4556bd0
file  /etc/systemd/system/vc-sysmon.service
http_header  x-vc-opt
ipv4  142.93.149[.]77
ipv4  104.248.126[.]159

Behavioural indicators, per Arista's guidance on what to look for in VCO logs:

6. Detection

rule Arista_VeloCloud_VCO_Backdoor_Sept2026
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-22"
        reference = "https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html"
        description = "Detects backdoor daemon and service artefacts associated with compromise of VeloCloud Orchestrator via CVE-2026-93952, per Arista advisory indicators"
    strings:
        $file1 = "/usr/local/sbin/.vcnode.js" ascii
        $file2 = "/usr/local/sbin/vc-sysmond" ascii
        $file3 = "/etc/systemd/system/vc-sysmon.service" ascii
        $svc = "vc-sysmon" ascii
    condition:
        2 of them
}

title: Arista VeloCloud Orchestrator backdoor service or daemon creation
id: 7c1f2a44-8b3e-4d19-9f60-2a5e6d81c903
status: experimental
description: Detects creation or presence of the vc-sysmon service or vc-sysmond daemon on a VeloCloud Orchestrator host, per Arista compromise indicators for CVE-2026-93952.
references:

    - https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html
author: Adverse Trace
date: 2026-09-22
logsource:
    product: linux
    service: systemd
detection:
    selection_service:
        type: systemd
        message|contains:

            - '/etc/systemd/system/vc-sysmon.service'
            - 'vc-sysmon.service'
    condition: selection_service
falsepositives:

    - Legitimate VeloCloud system monitoring components with similar names; verify against the published md5 for vc-sysmond before escalation
level: high

A second Sigma rule for the nginx log header:

title: VeloCloud Orchestrator nginx requests carrying x-vc-opt header
id: 3e9a5b17-6c2d-4f80-b1a4-9d0e7f52c618
status: experimental
description: Detects HTTP requests to the VeloCloud Orchestrator web interface containing the x-vc-opt header, listed by Arista as a compromise indicator for CVE-2026-93952.
references:

    - https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html
author: Adverse Trace
date: 2026-09-22
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        sc-status: '*'
        http_header_x-vc-opt: '*'
    condition: selection
falsepositives:

    - Unknown; header is not part of documented normal VCO operation
level: high

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• The Hacker News, "New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups", https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html, 2026-09-22
• The Register Security, "Arista patches actively exploited VeloCloud bug as CISA puts admins on the clock", https://www.theregister.com/security/2026/07/28/arista-patches-actively-exploited-velocloud-bug-as-cisa-puts-admins-on-the-clock/5279414, 2026-07-28
• The Hacker News, "Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw", https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html, 2026-07
• CISA Known Exploited Vulnerabilities, "CVE-2026-16812 — Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability", https://nvd.nist.gov/vuln/detail/CVE-2026-16812, KEV due date 2026-07-30
• SecurityWeek, "Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day", https://www.securityweek.com/critical-arista-velocloud-orchestrator-vulnerability-exploited-as-zero-day/, 2026-07
• BleepingComputer, "Arista patches VeloCloud Orchestrator zero-day exploited in attacks", https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/, 2026-07
• BSI Germany, "[NEU] [hoch] Arista VeloCloud Orchestrator: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Root-Rechten", https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2702, 2026

8. Adverse Trace position

We assess CVE-2026-93952 as critical on the verified CVSS 9.5 score, with active exploitation confirmed by the vendor and no fix available yet on the 6.1 and 7.0 release trains; the vendor's CVSS 10.0 figure is noted but the verified score governs our rating. The conditional exposure (certificate-based Edge authentication plus web interface reachability plus possession of an Edge certificate's public part) narrows the affected population relative to July's CVE-2026-16812, but for EMEA financial services firms running certificate-mode VCO on an unpatched train this is an immediate exposure of the device that controls branch and datacentre WAN connectivity, and a compromised orchestrator extends to the managed Edge fleet. The IOC set and the absence of a documented post-exploitation chain are single-sourced from Arista's advisory as relayed by one outlet, and no actor attribution exists in any source, so we treat attribution as unconfirmed and recommend verifying indicators before enforcement. We will track Arista's advisory for the 6.1 and 7.0 train fixes, monitor for CISA KEV listing of CVE-2026-93952, and update this advisory if the affected version enumeration or any attribution reporting emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.