Arista Networks has shipped emergency patches for CVE-2026-93952, a CVSS 10.0 (3.1) / 9.5 (4.0) improper input validation flaw in VeloCloud Orchestrator (VCO) On-Prem — the centralized control plane that provisions, monitors, and manages fleets of VeloCloud SD-WAN Edge appliances. CISA added the bug to its Known Exploited Vulnerabilities catalog on September 22, confirming it’s being actively exploited, and gave federal civilian agencies until September 25 to remediate.

What’s broken

VCO deployments that use certificate-based authentication for the VeloCloud Edge-to-Orchestrator channel are exposed. The orchestrator fails to properly validate attacker-supplied input during that authentication exchange (CWE-20), and an attacker who can reach the VCO web UI and possesses only the public portion of a VeloCloud Edge’s authentication certificate — no tenant credentials, no operator login, no valid private key — can reach privileged internal host functionality that should require an authenticated session.

That’s a low-complexity, unauthenticated, no-user-interaction bug sitting on a network management control plane. Arista says the issue was surfaced through external research rather than found internally, and CISA’s KEV listing confirms it’s already being used in real attacks — this shipped as an emergency fix for a live zero-day, not a routine disclosure.

Impact

VCO is the single pane of glass that pushes configuration to every managed VeloCloud Edge in a deployment. Successful exploitation compromises the confidentiality, integrity, and availability of the orchestrator itself and the operational data it holds — customer topology, routing policy, device inventory — and a compromised VCO gives an attacker a foothold to reach the Edge devices it manages. For an SD-WAN control plane, that’s the difference between “one appliance popped” and “every branch office and remote site behind this orchestrator is now reachable.”

Only deployments with certificate-based Edge→VCO authentication configured are exposed; VCO instances that don’t use that auth mode aren’t affected by this specific path. But certificate-based auth is a common, often-recommended configuration for VeloCloud fleets, so the exposed population is meaningful.

Patch status

Fixes are available now for two release trains:

  • 5.2.x → patched in 5.2.3.16
  • 6.4.x → patched in 6.4.2.8

The 6.1.x and 7.0.x trains do not yet have a fix. If you’re running either, you’re currently stuck with compensating controls until Arista ships one — treat that as an active-risk state, not a wait-and-see one.

Mitigation

  1. Patch immediately if you’re on the 5.2.x or 6.4.x trains — this is a live, KEV-listed zero-day, not a theoretical risk.
  2. On 6.1.x/7.0.x with no fix yet: restrict network access to the VCO web UI to trusted management networks only, and monitor Arista’s advisory (Security Advisory 0183) for the pending patch.
  3. Audit your Edge→VCO authentication mode. If you’re not actually relying on certificate-based authentication, confirm it’s disabled — that removes this specific attack path entirely.
  4. Hunt for compromise indicators on any internet- or broadly-reachable VCO instance: unexpected admin/operator actions in orchestrator audit logs, unfamiliar Edge device enrollments, configuration pushes you didn’t initiate, and anomalous API calls to internal VCO host functions from unrecognized sources.
  5. Rotate credentials and re-validate device trust on any orchestrator you can’t rule out as compromised — a control plane breach on SD-WAN infrastructure is a “assume broader compromise until proven otherwise” event given the blast radius across managed edges.

Why this one matters

SD-WAN orchestrators sit at exactly the chokepoint attackers want: one authentication bypass on the control plane potentially reaches every branch, every remote site, and every Edge appliance the platform manages. Combined with the CVSS 10 score, confirmed pre-patch exploitation, and two release trains still waiting on a fix, this belongs on the same urgency tier as the wave of edge-appliance zero-days that hit VPN and firewall vendors earlier this year — patch now, don’t wait for a KEV deadline to force the issue.

References