New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Attackers are exploiting a CVSS 10.0 flaw in on-premises Arista VeloCloud Orchestrator deployments that use certificate authentication.
Arista said attackers are exploiting CVE-2026-93952, a CVSS 10.0 flaw in on-premises VeloCloud Orchestrator when Edges authenticate with certificates. An unauthenticated remote attacker who can reach the VCO web interface and knows the public part of an Edge certificate can invoke internal functions and compromise the orchestrator and managed Edge devices. Fixes are available for the 5.2 train from 5.2.3.16 and the 6.4 train from 6.4.2.8; 6.1 and 7.0 have no fix yet. Hosted and Dedicated VCO are already patched, and Arista published indicators including vc-sysmond and IPs 142.93.149.77 and 104.248.126.159.
- CVE-2026-93952 scores CVSS 10.0 and is actively exploited.
- Only certificate-authenticated on-premises VCO deployments are exposed.
- Patches exist for 5.2 and 6.4; 6.1 and 7.0 are still unfixed.
- Indicators include vc-sysmond and IPs 142.93.149.77 and 104.248.126.159.
- Vendors
- Arista
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-16812 | OS Command Injection in Arista VeloCloud Orchestrator On-Prem | 10.0 | 2% | KEV | KEV |
| CVE-2026-93952 | Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem) | 9.5 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.248.126.159 | TP header in nginx logs: x-vc-opt IP : 142.93.149[.]77 IP : 104.248.126[.]159 If you find any of these, preserve the state of the VCO a |
| ipv4 | 142.93.149.77 | /vc-sysmon.service HTTP header in nginx logs: x-vc-opt IP : 142.93.149[.]77 IP : 104.248.126[.]159 If you find any of these, preserve |
| ipv4 | 5.2.3.14 | 16812) fixed in 5.2 5.2.3.15 and earlier 5.2.3.16 and later 5.2.3.14 6.1 6.1.3.7 and earlier No fix yet 6.1.3.4 6.4 6.4.2.7 and |
| ipv4 | 6.1.3.4 | .3.16 and later 5.2.3.14 6.1 6.1.3.7 and earlier No fix yet 6.1.3.4 6.4 6.4.2.7 and earlier 6.4.2.8 and later 6.4.2.4 7.0 7.0.0 |
| ipv4 | 6.4.2.4 | o fix yet 6.1.3.4 6.4 6.4.2.7 and earlier 6.4.2.8 and later 6.4.2.4 7.0 7.0.0.2 and earlier No fix yet No fix listed. 7.0.0.1 a |
| md5 | dc78e206eaeadec59fc5801fe4556bd0 | de.js File : /usr/local/sbin/vc-sysmond MD5 ( vc-sysmond ): dc78e206eaeadec59fc5801fe4556bd0 File : /etc/systemd/system/vc-sysmon.service HTTP header in |
From the original article
3 min read at thehackernews.com
Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22. The flaw, tracked as CVE-2026-93952, may allow a remote attacker with no login access to privilege internal functions and affect the VCO host. Only orchestrators set up to authenticate their Edges with certificates are
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.