Arista VeloCloud Orchestrator: CVE-2026-93952 #
Arista Networks disclosed that certain versions of on-premises VeloCloud Orchestrator (VCO) contain an improper input validation vulnerability. An attacker can exploit this flaw to access privileged internal functionality and compromise the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and its managed data. This vulnerability has been designated CVE-2026-93952 and has been rated critical with a CVSS score of 9.5.
Exploitation requires network access to the VCO web interface and an active certificate-based authentication setup between a VeloCloud Edge and the Orchestrator; tenant or operator credentials are not required. Hosted versions (including Dedicated instances) were also affected and have already been patched by Arista.
Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 22, 2026.
The following versions are affected
- VCO 5.2.x: Versions 5.2.0 through 5.2.3.15
- VCO 6.1.x: Versions 6.1.0 through 6.1.3.7
- VCO 6.4.x: Versions 6.4.0 through 6.4.2.7
- VCO 7.0.x: Versions 7.0.0 through 7.0.0.2
What is Arista VeloCloud Orchestrator (VCO)? #
Arista VeloCloud Orchestrator (VCO) is the centralized management and orchestration component of the VeloCloud SD-WAN solution, used to configure, monitor, and manage VeloCloud Edge devices across an enterprise network.
What is the impact? #
Successful exploitation of this vulnerability would allow an unauthenticated remote attacker with network access to the web interface to compromise internal administrative functionality and gain complete control over the confidentiality, integrity, and availability of the orchestrator host and its managed enterprise network data.
Are any updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- VCO 5.2.x: Upgrade to version 5.2.3.16 or later.
- VCO 6.1.x: No fixed version is currently available.
- VCO 6.4.x: Upgrade to version 6.4.2.8 or later.
- VCO 7.0.x: No fixed version is currently available.
Note: Arista has not yet released fixes for the 6.1.x and 7.0.x release trains. As a temporary mitigation while patching is pending, restrict VCO web interface access to trusted administrative networks.
Finding exposed Arista VeloCloud Orchestrator appliances with runZero #
From the Service inventory, use the following query to locate potentially impacted installations:
_asset.protocol:=http AND protocol:=http AND (http.body:"single-spa-application:@velocloud/vco-header" OR last.http.body:"single-spa-application:@velocloud/vco-header")
