Arista Networks has released security patches for a zero-day vulnerability that is being actively exploited and impacts on-prem deployments of VeloCloud Orchestrator (VCO).
VCO is a cloud-based centralized management platform that helps administrators configure, monitor, and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices.
Tracked as CVE-2026-93952This maximum severity error is due to an incorrect input validation weakness and affects VCO deployments that have certificate-based authentication configured from VeloCloud Edge to VeloCloud Orchestrator (VCO).
Remote threat actors can exploit the vulnerability to access privileged internal VCO host functions in low-complexity attacks that do not require privileges on the target system or user interaction.
“This issue was discovered externally and is known to be being actively exploited,” the company said warned in a Tuesday alert. “Access to the public portion of the VeloCloud Edge authentication certificate is required. A successful attack requires network access to the VCO web interface. No VCO tenant or operator credentials are required for this disclosure.”
Arista says it has already patched hosted deployments with VCO 5.2.3.16 or later and VCO 6.4.2.8 or later, and that it will also release security patches for VCO instances with 6.1.3.7 and lower and 7.0.0.2 and lower.
The US Cybersecurity and Infrastructure Security Agency also added CVE-2026-93952 expanded its catalog of “known exploited vulnerabilities” on Tuesday and ordered U.S. civilian law enforcement agencies to secure their networks until Friday, September 25th.
Indicators of compromise
While security patches are deployed, administrators should restrict access to the VCO web interface to administrative networks, review recent administrator activity for unusual changes, and monitor for connections from known malicious IP addresses.
Administrators should review VCO web access logs for suspicious activity, such as: E.g. requests with encoded characters, unusual URL-like path components, references to local or internal services, or high request rates.
Arista also recommended that security teams block IP addresses 142(.)93.149.77 and 104(.)248.126.159 and review the Nginx logs for the x-vc-opt HTTP header, saying that unexpected outbound HTTP or HTTPS activity originating from the VCO host may also require further review.
“If a compromise is suspected, operators should retain VCO web access logs, backend application logs, system logs, database logs, and relevant file system timestamps prior to remediation if operationally feasible,” it added, recommending customers contact the Arista Networks Technical Assistance Center (TAC) if they require additional assistance.
Since the beginning of the year, Arista has fixed two additional zero-day bugs (CVE-2026-7473 in May and CVE-2026-16812 in July), which were actively exploited in attacks affecting Extensible Operating System (EOS) and on-premises VeloCloud Orchestrator deployments, respectively.
Arista Networks is a Fortune 500 company and one of the largest U.S. companies by revenue with more than 10,000 customers worldwide.
