Arista VeloCloud CVE-2026-93952: KEV Deadline, Affected Versions and Remediation
Arista disclosed CVE-2026-93952 on September 22, 2026, an actively exploited vulnerability in VeloCloud Orchestrator (VCO) that can give a remote attacker access to privileged internal functionality. The vendor rates the flaw CVSS 10.0 under CVSS v3.1 and 9.5 under CVSS v4.0. CISA added it to the Known Exploited Vulnerabilities catalog with a September 25 remediation deadline for affected federal civilian agencies.
The vulnerable product is VeloCloud Orchestrator On-Prem. Exposure requires certificate-based authentication between VeloCloud Edge and VCO, access to the public portion of an Edge authentication certificate, and network access to the VCO web interface. VCO tenant or operator credentials are not required. Arista says Hosted and Dedicated VCO services were also impacted and have already been patched.
For on-premises deployments, Arista has published fixes for the 5.2 and 6.4 trains: VCO 5.2.3.16 or later and VCO 6.4.2.8 or later. Its initial advisory does not yet name fixed builds for the affected 6.1 and 7.0 trains, so operators on those trains should follow the advisory and Arista TAC for an applicable remediation path.
Affected and fixed VCO versions
| VCO train | Affected versions in Arista SA-0183 | Fixed release listed in SA-0183 |
|---|---|---|
| 5.2.x | 5.2.3.15 and earlier | 5.2.3.16 and later in the 5.2.3 train |
| 6.1.x | 6.1.3.7 and earlier | No fixed build listed in revision 1.0 |
| 6.4.x | 6.4.2.7 and earlier | 6.4.2.8 and later in the 6.4.2 train |
| 7.0.x | 7.0.0.2 and earlier | No fixed build listed in revision 1.0 |
Arista says fixes for other supported release trains will be added as they become available. Customers on unsupported trains are directed to TAC to discuss upgrade options.
The advisory's platform scope is specific. VeloCloud Edge and VeloCloud Gateway are listed as unaffected products for this CVE; the vulnerable component is the orchestrator. This CVE is also separate from CVE-2026-16812, the earlier VCO vulnerability disclosed in 2026.
Which deployments are exposed
Arista lists three conditions that define the exposed configuration:
- Certificate-based authentication from VeloCloud Edge to VCO is configured.
- An attacker has access to the public portion of the VeloCloud Edge authentication certificate.
- The attacker can reach the VCO web interface over the network.
The attack path does not require VCO tenant or operator credentials. Restricting the VCO web interface to trusted administrative networks reduces exposure while operators move to a fixed release.
The vulnerability is classified as CWE-20, Improper Input Validation. Arista says successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and its managed data. A compromised orchestrator may also provide attackers access to managed VeloCloud Edge devices, which raises the incident-response scope beyond the VCO host itself.
Active exploitation and CISA KEV status
Arista states that the issue was discovered externally and is known to be actively exploited. CISA subsequently placed CVE-2026-93952 in its Known Exploited Vulnerabilities catalog on September 22.
The KEV remediation date is September 25, 2026, for organizations covered by the applicable federal directive. For other operators, KEV inclusion is a strong prioritization signal because it establishes observed exploitation.
The advisory provides no single definitive indicator that can independently establish compromise, so triage should correlate the published artifacts with host and network activity.
Indicators and hunting guidance
Arista's advisory provides several concrete artifacts for incident triage. Operators should investigate these file paths when present unexpectedly:
/usr/local/sbin/.vcnode.js/usr/local/sbin/vc-sysmond/etc/systemd/system/vc-sysmon.service
Arista lists MD5 dc78e206eaeadec59fc5801fe4556bd0 for the known malicious vc-sysmond file. It also identifies the x-vc-opt HTTP header in nginx logs and connections from 142.93.149.77 and 104.248.126.159 as indicators requiring investigation.
VCO web-access logs should be reviewed for unusual URL-like path components, encoded characters, references to local or internal services, and abnormal request rates. Correlate those events with backend application and system logs around the same timestamps. Unexpected outbound HTTP/HTTPS traffic, configuration changes, privileged maintenance actions, command execution, file creation, database exports, archive artifacts, or access to credentials and key material warrant further investigation.
Arista recommends preserving relevant VCO state and logs and contacting TAC or the account team when compromise indicators are found. Where operationally feasible, preserve web-access, backend, system and database logs plus relevant filesystem timestamps before remediation.
Remediation priorities
For exposed on-premises VCO installations on the 5.2 or 6.4 trains, move to the fixed release listed for that train as soon as operationally possible. For affected 6.1 and 7.0 installations, monitor SA-0183 for the applicable fixed build and engage Arista TAC for the supported remediation path.
Until a fixed build is deployed, Arista recommends restricting the VCO web interface to trusted administrative networks, monitoring access from known malicious sources, reviewing unexpected outbound activity, limiting unnecessary outbound ports, and monitoring for backdoor daemons and webshells.
Patching closes the vulnerable software path. Systems with evidence of prior compromise require incident response as well: Arista's post-remediation guidance includes credential rotation, review of administrator activity, validation of managed-device state, and restoration or replacement of affected orchestrator instances from trusted sources when appropriate.
Bottom line
CVE-2026-93952 combines confirmed active exploitation with control-plane impact on VeloCloud Orchestrator. Operators should first identify on-prem VCO versions and certificate-based Edge authentication, then apply the published 5.2.3.16 or 6.4.2.8 fixes where applicable. Affected 6.1 and 7.0 deployments need the vendor's applicable remediation path as fixed builds are published. Because Arista has released concrete compromise artifacts, remediation should include log and host triage in addition to version verification.
Sources
- Arista Security Advisory 0183: https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
- CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952
- CVE record for CVE-2026-93952: https://www.cve.org/CVERecord?id=CVE-2026-93952
- SecurityWeek — Arista urges immediate patching of exploited VCO zero-day: https://www.securityweek.com/arista-urges-immediate-patching-of-exploited-vco-zero-day/