Arista Warns of Actively Exploited VeloCloud Orchestrator Zero-Day

Arista Networks has warned that attackers are actively exploiting a VeloCloud Orchestrator zero-day affecting on-premises deployments. The company has patched certain hosted versions and plans to release fixes for additional versions.

Flaw Exposes Privileged Host Functions

The maximum-severity vulnerability, CVE-2026-93952, stems from improper input validation. It affects deployments that use certificate-based authentication between VeloCloud Edge and VeloCloud Orchestrator, also known as VCO.

An attacker needs network access to the VCO web interface and the public portion of an Edge authentication certificate. However, the attacker does not need VCO tenant or operator credentials.

A successful attack can provide access to privileged functions on the VCO host. Arista says an external party discovered the flaw and that attackers are already exploiting it.

Hosted Versions Patched as More Fixes Approach

Arista says it has patched hosted deployments running VCO 5.2.3.16 or later and 6.4.2.8 or later. It also plans to release patches for instances running VCO 6.1.3.7 and earlier, as well as 7.0.0.2 and earlier.

Meanwhile, the US Cybersecurity and Infrastructure Security Agency has added CVE-2026-93952 to its Known Exploited Vulnerabilities catalog. Federal civilian agencies must address the flaw by September 25, 2026.

Administrators Should Check for Compromise

While awaiting a fix, administrators should restrict access to the VCO web interface to administrative networks. They should also review recent administrator activity and VCO web access logs.

The VeloCloud Orchestrator zero-day may leave signs of suspicious web requests. These include encoded characters, unusual paths, references to internal services and unusually high request rates.

Arista also recommends checking nginx logs for the x-vc-opt HTTP header. In addition, teams should block the IP addresses 142[.]93.149.77 and 104[.]248.126.159 and investigate unexpected outbound traffic from the VCO host.

If administrators suspect a breach, Arista advises them to preserve relevant logs and file-system timestamps before remediation where possible. They can also contact Arista’s Technical Assistance Center for help.