Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)

Affected Vendors

Arista, VeloCloud

Affected Components

VeloCloud Orchestrator (VCO)

Published Date

2026-09-22

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Arista VeloCloud Orchestrator (VCO) On-premise deployments.

Impact

Unauthenticated remote attackers can access privileged internal functions, leading to full compromise of the orchestrator and managed SD-WAN infrastructure.

Mitigation

Immediately apply the latest security patches from Arista and restrict access to management interfaces via VPN/ACLs.

Affected Products & Version Scope

All on-premise versions of Arista VeloCloud Orchestrator (VCO). Hosted and Dedicated cloud versions have already been remediated by the vendor.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Immediate Patching: Download and install the latest software release from the Arista Support portal that addresses CVE-2026-93952.

Restrict Management Access: Ensure that the VCO management console is not reachable from the public internet. Implement strict Access Control Lists (ACLs).

text

# Recommended Security Posture:
- Place VCO behind a Management VPN.
- Disable unnecessary services and ports.
- Enable Multi-Factor Authentication (MFA) for all administrative accounts.

Log Analysis: Monitor system logs for unusual activity, specifically focusing on unauthorized access to internal API endpoints or unexpected configuration changes.

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild (CISA KEV), immediate remediation is mandatory. Organizations using on-premise VCO must prioritize this update to prevent potential network-wide compromise.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

CVE-2026-93952 is a critical vulnerability caused by improper input validation (CWE-20) within the VeloCloud Orchestrator (VCO). It allows an unauthenticated remote attacker to bypass security controls and interact with privileged internal system components. With a CVSS score of 10.0 and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this flaw represents a maximum-level risk. Exploitation can lead to a total loss of Confidentiality, Integrity, and Availability (CIA) for the orchestrator and all SD-WAN edge devices managed by it.

Official Vendor Advisories & References

NVD Original English Description

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183

Source: psirt@arista.com · Mitigation, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: