Affected Systems
Arista VeloCloud Orchestrator (VCO) On-Prem deployments with certificate-based authentication enabled. Hosted deployments running VCO versions below 5.2.3.16 (5.x branch), below 6.4.2.8 (6.x branch), 6.1.3.7 and below, and 7.0.0.2 and below are vulnerable. Hosted VCO instances already patched by Arista.
Exploitation Status
Actively exploited in the wild. CISA added CVE-2026-93952 to KEV catalog. Threat actors require access to the public portion of VeloCloud Edge authentication certificate and network access to VCO web interface. No credentials or user interaction required.
Business Impact
Maximum severity improper input validation flaw allows remote unauthenticated attackers to access privileged internal VCO host functionality. VCO is a centralized SD-WAN management platform used by enterprise networks. Successful exploitation grants privileged access without credentials, enabling potential network-wide compromise of SD-WAN infrastructure. Federal agencies ordered to patch by September 25, 2026.
Urgency
🔴 Immediate
Recommended Actions
- Apply Arista security patches immediately for on-premises VCO deployments (5.2.3.16+, 6.4.2.8+, and forthcoming patches for 6.1.3.7 and 7.0.0.2 branches)
- Restrict VCO web interface access to administrative networks only until patched
- Block malicious IPs 142.93.149.77 and 104.248.126.159 at perimeter firewalls
- Review nginx logs for x-vc-opt HTTP header and VCO web access logs for encoded characters, unusual URL paths, references to internal services, or high request rates
- Monitor for unexpected outbound HTTP/HTTPS traffic from VCO hosts and preserve logs (web access, backend application, system, database, filesystem timestamps) if compromise suspected