CVE-2026-93952: New CVSS 10.0 VeloCloud Orchestrator Flaw Exploited in Certificate-Based Setups

Arista has confirmed active exploitation of CVE-2026-93952, a second CVSS 10.0 vulnerability in on-prem VeloCloud Orchestrator this year. This one only bites deployments that authenticate Edges with certificates — and two of the four release trains still don't have a fix.

Arista Networks disclosed on September 22, 2026, that attackers are actively exploiting a new, unpatched vulnerability in on-premises VeloCloud Orchestrator (VCO) — the management server that runs SD-WAN deployments built on VeloCloud technology. The flaw carries a CVSS 3.1 base score of 10.0, the maximum possible rating, and Arista says it was discovered through external reporting rather than internal testing.^[1]

This isn't VCO's first brush with a perfect-10 score this year. In July, Arista patched a different flaw in the same product, also scored 10.0, also under active exploitation.^[4][5] The two are not the same bug, and it's worth being precise about that rather than lumping them together.

What Was Disclosed

The new vulnerability is tracked as CVE-2026-93952. Arista's advisory describes it as a security issue that "may allow a remote attacker to access privileged internal functionality and impact the VCO host," with successful exploitation potentially compromising confidentiality, integrity, and availability of the orchestrator and the data it manages.^[1] The underlying weakness is classified as CWE-20, improper input validation — a different root cause than July's OS command injection flaw.

Arista's advisory is blunt about the exploitation status: "This issue was discovered externally and is known to be actively exploited."^[1] The company has not disclosed when the attacks began, how many organizations were affected, or who is behind them. The Hacker News reported it had reached out to Arista for further comment and had not yet received a response at the time of publication.^[2]

Who Is Actually Exposed

This is the detail that separates CVE-2026-93952 from July's flaw, and it matters for figuring out whether you need to act today or just soon. July's bug exposed VCO by default, in every configuration — Arista said outright that "there is no configuration that can prevent the exposure."^[5] This new one is narrower. Arista states an orchestrator is exposed only if certificate-based authentication from the VeloCloud Edge to the Orchestrator is configured.^[1]

VeloCloud Edges can authenticate to the Orchestrator in one of three modes: Certificate Deactivated, which uses a pre-shared key, or Certificate Acquire and Certificate Required, both of which use a certificate issued by the orchestrator.^[2] Arista's advisory doesn't spell out which of the certificate-based modes triggers the exposure — it simply says certificate-based authentication has to be configured. If your deployment relies on pre-shared keys instead, this particular flaw shouldn't reach you, though that's a narrower claim than saying the product itself is safe.

Beyond that configuration requirement, Arista lists two more conditions: the attacker needs network access to the VCO web interface, and needs the public portion of an Edge's authentication certificate.^[1] Notably, no VCO tenant or operator credentials are required — this is still an unauthenticated path into the system for anyone who meets those two conditions.

Severity, By The Numbers

Arista scored the flaw at 10.0 under CVSS 3.1 (vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and 9.5 under CVSS 4.0 (vector: AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).^[1] The gap between the two scores is worth noting — CVSS 4.0's attack-complexity factor is rated High rather than Low, which pulls the score down slightly even though the practical risk described is the same. Severity scoring describes how bad a successful attack could be, not whether one is currently happening; Arista's separate statement about active exploitation is what actually elevates the urgency here beyond the number itself.

Affected Versions and Fixes

Two of the four VCO release trains have patches available. Two don't, as of this writing.

VeloCloud Orchestrator Hosted and Dedicated deployments — the versions Arista runs on customers' behalf rather than the on-prem software customers manage themselves — were already patched, according to the advisory.^[1] VeloCloud Gateway and VeloCloud Edge products are not affected by this particular vulnerability.^[1] Arista says fixes for the remaining supported trains are coming and will be added to the advisory when ready; customers on an unsupported train should contact Arista's Technical Assistance Center about upgrade paths.^[1]

Signs of Compromise

Arista is explicit that there's no single indicator that proves a VCO was compromised through this flaw. Instead, the company points administrators toward log review: check VCO web access logs for requests with unusual URL-like paths, encoded characters, references to local or internal services, or abnormally high request rates.^[1]

If you find any of the following, Arista asks that you preserve the system state and contact its Technical Assistance Center rather than remediating immediately:

• File: /usr/local/sbin/.vcnode.js
• File: /usr/local/sbin/vc-sysmond (known malicious MD5: dc78e206eaeadec59fc5801fe4556bd0)
• File: /etc/systemd/system/vc-sysmon.service
• HTTP header x-vc-opt in nginx logs
• Connections from 142.93.149.77 or 104.248.126.159

These are the indicators Arista itself published — this is not a reconstructed or inferred list. If any of them show up, the company recommends preserving web access logs, backend application logs, system logs, database logs, and file-system timestamps before taking remediation steps, where that's operationally feasible.^[1]

Mitigation If You Can't Patch Yet

For the 6.1.x and 7.0.x trains, where no fix exists yet, Arista's guidance amounts to reducing exposure rather than eliminating it. The company recommends limiting VCO web interface access to trusted administrative networks, monitoring for connections from known-malicious IPs, watching for unexpected outbound traffic from the VCO host, considering outbound port restrictions where not needed for normal operation, monitoring for backdoor daemons and webshells, and reviewing recent administrator activity for changes that don't match expected workflows.^[1]

After upgrading, Arista also recommends standard post-incident hygiene: rotating credentials, reviewing administrator activity, checking the state of managed Edge devices, and restoring or replacing the orchestrator from trusted sources if compromise is suspected.^[1] That last point matters because a compromised VCO doesn't just put the orchestrator itself at risk — it can also give an attacker a path to the Edge devices the orchestrator manages, extending the blast radius well past the management server.

What Isn't Known Yet

Arista hasn't said how attackers are actually exploiting this in practice, how long the exploitation has been going on, or how many organizations have been affected. It also hasn't identified who's behind the activity. None of that has been independently reported elsewhere as of this writing, and speculating about attacker identity or campaign scope without evidence would go beyond what's currently known. Whether this CVE lands in CISA's KEV catalog, and when, also remains to be seen — check CISA's current catalog directly rather than assuming based on the CVSS score or the "actively exploited" language alone.

The Takeaway

If you're running VeloCloud Orchestrator on-prem with certificate-based Edge authentication, this is worth checking today, not next sprint. Confirm your release train and version against the table above, patch immediately if you're on 5.2.x or 6.4.x, and if you're stuck on 6.1.x or 7.0.x, lock down web interface access and start watching for the published indicators while you wait on a fix. The fact that this is the second perfect-10 VCO flaw disclosed as actively exploited within a few months is also a reasonable prompt to double-check whether your organization has fully verified it applied July's fix, not just this one.

Sources & References

1. Arista Networks — Security Advisory 0183 (CVE-2026-93952), September 22, 2026
2. The Hacker News — "New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups," September 22, 2026
3. Arista — SD-WAN 7.0 Admin Guide, Provisioning a New Edge (authentication modes)
4. NVD — CVE-2026-16812 Detail (Arista VeloCloud Orchestrator On-Prem OS Command Injection, CISA KEV entry)
5. BleepingComputer — "Arista patches VeloCloud Orchestrator zero-day exploited in attacks," July 2026