Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day
Share
Arista Networks has released emergency security patches to address a maximum-severity zero-day vulnerability in its VeloCloud Orchestrator (VCO) On-Prem deployments. The flaw, tracked as CVE-2026-93952, is currently being exploited by remote threat actors.
VCO serves as a centralised management platform used by administrators to configure and monitor VeloCloud Software-Defined Wide Area Networks (SD-WAN) and associated edge devices. This incident follows previous urgent security updates required for the VeloCloud platform earlier this year.
Technical details and exploitation risk
The vulnerability is the result of improper input validation. It specifically impacts VCO deployments where certificate-based authentication from the VeloCloud Edge to the VeloCloud Orchestrator is configured.
Security researchers noted that the flaw allows remote attackers to access privileged internal VCO host functionality. The attack is classified as low-complexity, as it requires no user interaction and no existing privileges on the targeted system or user account. To facilitate an attack, a threat actor only needs network access to the VCO web interface and access to the public portion of the VeloCloud Edge authentication certificate.
CISA mandates federal remediation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-93952 to its Known Exploited Vulnerabilities catalogue. In response to the active exploitation, CISA has ordered U.S. federal civilian executive branch agencies to secure their networks by Friday, 25 September 2026.
Mitigation and indicators of compromise
While organisations deploy the necessary patches, Arista recommends that administrators implement immediate defensive measures. These include restricting access to the VCO web interface to authorised administrative networks and monitoring for unusual changes in administrator activity.
Security teams should review VCO web access logs for suspicious indicators, such as:
- Requests containing encoded characters
- Unusual URL-like path components
- References to local or internal services
- High request rates
Arista has advised security professionals to block the following malicious IP addresses: 142.93.149.77 and 104.248.126.159. Additionally, administrators should review nginx logs specifically for the x-vc-opt HTTP header and investigate any unexpected outbound HTTP or HTTPS activity originating from the VCO host.
If a compromise is suspected, operators are advised to preserve VCO web access logs, backend application logs, system logs, and database logs before beginning remediation efforts.
