Posted on

VeloCloud Orchestrator CVE-2026-93952 – Actively Exploited CVSS 10.0 Pre-Authentication Compromise

Threat Overview

Arista disclosed CVE-2026-93952 on September 22, 2026 and states that the vulnerability is actively exploited. The flaw affects on-premises VeloCloud Orchestrator deployments configured for certificate-based Edge authentication. A remote unauthenticated attacker who can reach the VCO web interface and possesses the public portion of an Edge authentication certificate may invoke internal functionality and compromise the VCO host. A compromised orchestrator can expose data managed by VCO and may provide a path to managed Edge devices. Arista supplied concrete compromise artifacts including hidden files, a systemd service, an nginx header, hashes, and attacker IP addresses.

References

Impacted Systems

Arista VeloCloud Orchestrator on-premises deployments using certificate-based Edge authentication. Affected: 5.2.3.15 and earlier, fixed 5.2.3.16+; 6.1.3.7 and earlier, no fix available at publication; 6.4.2.7 and earlier, fixed 6.4.2.8+; 7.0.0.2 and earlier, no fix available at publication. Arista Hosted and Dedicated VCO services were already patched.

Why this matters

VCO is a centralized SD-WAN management plane. Successful compromise can affect the orchestrator host, sensitive management data, and potentially managed Edge devices. Active exploitation and CVSS 10.0 make this an emergency hunt and remediation item.

Exploitation Status

Arista states the vulnerability was discovered externally and is known to be actively exploited. Public reporting does not establish the campaign start date, scale, or actor attribution.

What this hunt looks for

Vendor-published compromise artifacts, attacker IPs, the x-vc-opt nginx header, suspicious VCO web activity, systemd persistence, sensitive-path file creation, and unexpected outbound connections.

Required logs

VCO/Linux Syslog, Defender XDR DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents where available, plus web or reverse-proxy logs if ingested.

First Pass – Published VCO Compromise Artifacts

let IOCs=dynamic(["/usr/local/sbin/.vcnode.js","/usr/local/sbin/vc-sysmond","/etc/systemd/system/vc-sysmon.service","dc78e206eaeadec59fc5801fe4556bd0"]);
union isfuzzy=true DeviceFileEvents,DeviceProcessEvents
| where Timestamp >= ago(30d)
| where tostring(FileName) has_any (IOCs) or tostring(FolderPath) has_any (IOCs) or tostring(SHA256) has_any (IOCs) or tostring(ProcessCommandLine) has_any (IOCs)
| project Timestamp,DeviceName,ActionType,FileName,FolderPath,SHA256,ProcessCommandLine
| order by Timestamp desc

Published VCO Attacker IPs

DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP in ("142.93.149.77","104.248.126.159")
| project Timestamp,DeviceName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteIP,RemotePort,RemoteUrl
| order by Timestamp desc

VCO nginx x-vc-opt Header

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has "x-vc-opt"
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Suspicious VCO Web Requests

Syslog
| where TimeGenerated >= ago(30d)
| where ProcessName has_any ("nginx","httpd")
| where SyslogMessage has_any ("%2f","%2e","127.0.0.1","localhost","169.254.","x-vc-opt")
| project TimeGenerated,Computer,HostName,ProcessName,SyslogMessage
| order by TimeGenerated desc

VCO Persistence via systemd

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("vc-sysmon.service","systemctl","daemon-reload")
| project TimeGenerated,Computer,HostName,ProcessName,SyslogMessage
| order by TimeGenerated desc

Unexpected VCO Outbound Connections

DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where DeviceName has_any ("vco","velocloud","orchestrator")
| project Timestamp,DeviceName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort
| order by Timestamp desc

VCO File Creation in Sensitive Paths

DeviceFileEvents
| where Timestamp >= ago(30d)
| where DeviceName has_any ("vco","velocloud","orchestrator")
| where ActionType in~ ("FileCreated","FileModified")
| where FolderPath startswith "/usr/local/sbin" or FolderPath startswith "/etc/systemd/system"
| project Timestamp,DeviceName,ActionType,FileName,FolderPath,SHA256,InitiatingProcessCommandLine
| order by Timestamp desc

Syslog IOC Fallback

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any (".vcnode.js","vc-sysmond","vc-sysmon.service","142.93.149.77","104.248.126.159","x-vc-opt")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Detection Notes

The published file names, MD5, header, and IP addresses are the highest-signal pivots. Device* queries require Defender endpoint telemetry on the VCO host, which may not exist for appliance deployments. Syslog visibility depends on VCO logs being forwarded. Arista states no single indicator proves or disproves exploitation.

Leave a comment