CVE-2026-93952
Description
Critical CVSS 10.0 vulnerability in Arista VeloCloud Orchestrator allows remote attackers to compromise SD-WAN management. Actively exploited.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| velocloud_orchestrator | 5.2.0 | 5.2.3.16 | vulnerable |
| velocloud_orchestrator | 6.1.0 | 6.1.3.7 | vulnerable |
| velocloud_orchestrator | 6.4.0 | 6.4.2.8 | vulnerable |
| velocloud_orchestrator | 7.0.0 | 7.0.0.2 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately apply the security updates provided by Arista for on-premises VeloCloud Orchestrator (VCO) installations. Refer to Arista Security Advisory 0183 for specific patch files and installation procedures.
Update affected systems
Ensure all VCO instances are running non-vulnerable versions. Upgrade to version 5.2.3.16, 6.4.2.8, or the latest patched releases for the 6.1.x and 7.0.x branches as specified in the vendor documentation.
Restrict access
Implement strict network segmentation and firewall rules to isolate the VeloCloud Orchestrator management interface. Restrict access to known, trusted administrative IP addresses and disable public internet exposure where possible.
Monitor for exploitation
Conduct forensic triage following CISA BOD 26-04 guidelines. Scan web server logs for unauthorized calls to internal API endpoints and monitor for suspicious administrative account creation or configuration changes.
Detection Guidance
"Detecting exploitation of CVE-2026-93952 requires monitoring network traffic to the VCO management interface for unusual API requests. Security teams should inspect logs for unauthenticated access attempts to privileged internal functions. Look for indicators of compromise (IOCs) such as unexpected outbound connections from the VCO host, the presence of unauthorized administrative users, or modifications to SD-WAN routing policies that were not initiated by authorized personnel."