An extremely severe vulnerability (CVSS 10.0) in on-premises VeloCloud Orchestrator (VCO), a key server in VeloCloud SD-WAN setups, is currently being exploited in the wild. The flaw, tracked as CVE-2026-93952, enables remote attackers with no login access to escalate privileges within the orchestrator—potentially gaining control over both the server and connected Edge devices. This exposure affects setups that use certificate-based authentication.
Details of the Exposure
The vulnerability only applies to VCO installations that require or acquire certificates for Edge devices to authenticate. In contrast, setups using pre-shared keys (PSKs) instead of certificates are not exposed. Attackers also need network access to the VCO web interface, and must possess the public portion of an Edge’s certificate to exploit the flaw. The flaw was first reported externally and is understood to be under active exploitation, though the start date and scale of attacks remain unclear.
Affected Versions and Patch Status
Multiple release trains are impacted: versions 5.2 (5.2.3.15 and earlier), 6.4 (up to 6.4.2.7), and others. Patches already released address the issue for the 5.2.3.16+ and 6.4.2.8+ versions. For release trains 6.1 and 7.0, no patch is yet available. All Hosted and Dedicated VCO versions have received fixes.
Mitigations & Detection Guidance
For organizations unable to immediately upgrade, several interim measures are advised:
- Restrict web-interface access to trusted administrative networks.
- Monitor the VCO for incoming connections from suspicious IP addresses.
- Watch for unexpected outbound traffic or involvement of unrecognized ports or processes.
- Audit recent administrative actions for anomalies.
Arista also lists specific indicators of compromise (IoCs) to look out for, including unusual files like /usr/local/sbin/.vcnode.jsand /usr/local/sbin/vc-sysmond, a specific MD5 hash for vc-sysmond, certain systemd service units, nginx headers such as x-vc-opt, and IPs like 142.93.149[.]77 and 104.248.126[.]159. If any are detected, preserve system state and contact technical support.
This flaw is the second major VCO issue this year; another critical vulnerability (CVE-2026-16812) was exploited in July and affected earlier version trains regardless of configuration. That one has been fixed across all affected trains.
What to do now:If your deployment uses certificate-based Edge authentication, verify your VCO version. If it’s one of the vulnerable releases, prioritize upgrading to a patched build. If an upgrade isn’t immediately possible, follow the mitigation steps above and monitor your system closely. If you see signs of compromise, preserve logs and system metadata before taking remedial action.
This vulnerability matters because VCO is central to SD-WAN architecture, orchestrating traffic between Edge devices and the core network. A full compromise can ripple across infrastructure. Vigilance, timely patching, and configuration review now can prevent what could become serious security incidents. What’s worth watching: whether more telemetry emerges about how widespread the exploitation is, how quickly patches for 6.1 and 7.0 arrive, and whether similar certificate-authentication flaws lurk undetected in related network management tools.
