Security Advisory 0183 (CVE-2026-93952)

What is affected, what to do

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

The vulnerability is being actively exploited; treat it as a priority. Update velocloud_orchestrator to version 6.4.2.8, VeloCloud Orchestrator to version 5.2.3.16. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Arista Networks VeloCloud Orchestrator (VCO) On-Prem lte 5.2.0..5.2.3.15
• Arista Networks VeloCloud Orchestrator (VCO) On-Prem lte 6.1.0..6.1.3.7
• Arista Networks VeloCloud Orchestrator (VCO) On-Prem lte 6.4.0..6.4.2.7
• Arista Networks VeloCloud Orchestrator (VCO) On-Prem lte 7.0.0..7.0.0.2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory and version check: Identify every on-prem VeloCloud Orchestrator (VCO) instance, including lab and DR instances. Affected trains are 5.2.0–5.2.3.16, 6.1.0–6.1.3.7, 6.4.0–6.4.2.8 and 7.0.0–7.0.0.2. Hosted and Dedicated VCO instances have already been patched by the vendor. For those, confirm status with Arista support.
   • Apply the patch: A patch is available from the vendor. Look up the fixed version for each branch (5.2, 6.1, 6.4, 7.0) in the Arista/VeloCloud vendor advisory. Before upgrading, snapshot the VCO VM and back up the database to preserve forensic evidence.
   • Cut exposure now: If the VCO web UI or API (typically HTTPS/443) is reachable from the internet, restrict it to admin jump hosts or VPN until patched. Keep reachability for your own SD-WAN edges and gateways so the control plane stays up.
   • Check for compromise before trusting the box: The flaw grants access to privileged internal functionality and the host itself, so look for anomalies in two places:
     • VCO host: new local users, SSH keys, cron jobs, web shells
     • Orchestrator layer: newly created Operator or Enterprise admins, API tokens
   • Rotate credentials: After patching, rotate all VCO Operator and Enterprise admin passwords and revoke and reissue API tokens. Also rotate secrets stored in the VCO: SNMP, RADIUS/TACACS, SMTP, cloud-security integrations, and IPsec PSKs for non-VeloCloud sites.
   • Validate managed edges: Diff recently pushed profiles and configs against your known-good baseline. Focus on firewall rules, business policies, routing/BGP neighbours and newly activated edges.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Move the VCO into a dedicated management zone. Allow inbound only:

     • edge and gateway traffic from known prefixes
     • admin access from a PAW or jump-host subnet

     Allow outbound only to required destinations (NTP, DNS, update servers). This hampers reverse shells and exfiltration.

   • WAF/reverse proxy: Front the VCO with a WAF-enabled reverse proxy and restrict administrative and internal API paths to admin source networks. Block or log requests with anomalous header combinations, path manipulation (../, double URL-encoding) or oversized parameters.

   • IPS: Enable vendor or community signatures for CVE-2026-93952 in Suricata/Snort as soon as they ship, scoped to the VCO segment. Until then, alert on any HTTP request to the VCO from non-allowlisted source networks.

   • IAM/least privilege:

     • Enforce MFA or IdP-backed SSO for all VCO logins.
     • Disable dormant Operator accounts.
     • Issue API tokens with minimal roles and short lifetimes.
     • Allow SSH to the VCO host key-only and from the jump-host network only.

   • Host hardening and logging: Enable auditd on the VCO host with execve rules for the web and application service accounts. Ship logs off-box via syslog so an attacker with host access cannot wipe them locally.

3. 03

   Runbook step 3

   Detection rules

   • VCO/proxy web access logs:
     • Requests to internal or administrative API endpoints without a preceding successful login
     • Unusual source IPs and bursts of 4xx/5xx responses on the same path
     • SPL sketch: index=proxy dest=<VCO> NOT src IN (<admin_nets>,<edge_nets>) | stats count by src, uri_path, status
   • Linux auditd/EDR process ancestry: Shells or network tools spawned by VCO web or application services. Sigma shape: parent_image|endswith: [java, node, nginx] AND image|endswith: [/sh, /bash, /curl, /wget, /nc, /python3].
   • Host persistence: Set auditd watches on /etc/passwd, /etc/shadow, ~/.ssh/authorized_keys, /etc/cron* and the web root directories. Alert on any change outside a change window.
   • Network telemetry (Zeek/Suricata): Outbound connections from the VCO to unknown external destinations, especially on non-standard ports or with large upload volumes. Zeek approach: compare conn.log where id.orig_h == <VCO> against an allowlist.
   • Orchestrator audit events: Alert on:
     • new admins or API tokens
     • role changes
     • bulk configuration pushes to edges
     • edge activations not tied to a change ticket

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Source: BSI CSAF, BSI WID Portal, NVD (NIST), cvelistv5, CISA KEV Catalog

Vendors and products

• Arista Networks VMware SD-WAN by VeloCloud
• Arista Networks

Weakness classes (CWE)

• CWE-20Improper Input Validation

  Class

  The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

  Entry at MITRE CWE-20

References & sources

• arista.comSecurity Advisory 0183Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952government-resource

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 23.09.2026Initial analysis by NVDNVD

   Newly listed as affected:

   • Arista Networks VMware SD-WAN by VeloCloud (5.2.0 – before 5.2.3.16; 6.1.0 – through 6.1.3.7; 6.4.0 – before 6.4.2.8; 7.0.0 – through 7.0.0.2)

   New references:

   • https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	added	—	OR *cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* versions from (including) 5.2.0 up to (excluding) 5.2.3.16 *cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* versions from (including) 6.1.0 up to (including) 6.1.3.7 *cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* versions from (including) 6.4.0 up to (excluding) 6.4.2.8 *cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* versions from (including) 7.0.0 up to (including) 7.0.0.2
   Reference type	added	—	Arista Networks, Inc.: https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183 Types: Mitigation, Vendor Advisory
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952 Types: US Government Resource

   Source identifier: nvd@nist.gov

2. 23.09.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-93952","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-22T19:40:04.719145Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-93952","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-22T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 22.09.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-09-22
   Due Date	added	—	2026-09-22
   Required Action	added	—	2026-09-22
   Vulnerability Name	added	—	2026-09-22

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

4. 22.09.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952
   SSVC assessment	removed	{"id":"CVE-2026-93952","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-22T13:13:56.046701Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-93952","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-22T19:40:04.719145Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 22.09.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: none known, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	added	—	{"id":"CVE-2026-93952","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-22T13:13:56.046701Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Linked advisories

• On-prem VeloCloud Orchestrator under attack, only some versions patchedCSO Online24.09.2026
• New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based SetupsThe Hacker News22.09.2026