Attackers are actively exploiting a maximum-severity vulnerability in on-premises VeloCloud Orchestrator (VCO), the server that manages Edge devices in a VeloCloud SD-WAN, Arista said on September 22.
Tracked as CVE-2026-93952, the flaw carries a CVSS 3.1 score of 10.0 and could let a remote attacker with no login access reach privileged internal functions and affect the VCO host. Only orchestrators configured to authenticate their Edges with certificates are exposed. Arista said the flaw was discovered externally and is known to be actively exploited, but did not say when attacks began or how widespread they are.
Fixed releases are available for the 5.2 and 6.4 trains as of September 22, but not yet for 6.1 and 7.0. Hosted and Dedicated VCO versions have already been patched. The affected releases include ones that fixed a different VCO flaw Arista reported as exploited in July - a bug that exposed VCO by default regardless of configuration.
A successful attack could compromise the orchestrator and the data it manages, and may also give attackers access to the Edge devices it controls. The attacker also needs network access to the VCO web interface and the public part of an Edge's authentication certificate.
Until a fix is installed, Arista recommends limiting VCO web interface access to trusted administrative networks, monitoring for access from known malicious IP addresses and for unexpected outbound traffic, blocking unneeded outbound ports, watching for backdoor daemons and webshells, and reviewing recent administrator activity.
Signs of compromise include files at /usr/local/sbin/.vcnode.js and /usr/local/sbin/vc-sysmond, an MD5 of dc78e206eaeadec59fc5801fe4556bd0 for vc-sysmond, a systemd service at /etc/systemd/system/vc-sysmon.service, the HTTP header x-vc-opt in nginx logs, and IPs 142.93.149[.]77 and 104.248.126[.]159. Arista said no single indicator proves compromise through this flaw. Those who find any should preserve the VCO's state and contact Arista's Technical Assistance Center or their account team.
Source: The Hackers News