Arista VeloCloud Orchestrator CVE-2026-93952: SD-WAN Auth Bypass Exploited in the Wild

An attacker who never held a password, never phished a tenant, and never touched an operator account reached the privileged internals of the box that controls an entire SD-WAN fabric — and did it before Arista shipped a patch. That is CVE-2026-93952, a CVSS 10.0 improper-input-validation flaw in Arista VeloCloud Orchestrator (VCO) On-Prem. CISA added it to the Known Exploited Vulnerabilities catalog on 22 September 2026 and gave federal agencies until 25 September — a 48-hour clock, which CISA reserves for the bugs already being used against real networks.

The reason this one deserves more than a line in a patch digest is not the score. It is what got owned. An SD-WAN orchestrator is not an edge box. It is the control plane that pushes configuration to every branch office you run.

What CVE-2026-93952 actually is

The flaw lives in how VCO On-Prem validates input on its web interface. Arista's Security Advisory 0183 describes it as improper input validation (CWE-20) that lets a remote attacker "access privileged internal functionality and impact the VCO host," compromising the confidentiality, integrity and availability of the orchestrator and the data it manages.

The precondition is the interesting part. The attack works when three things are true:

• Certificate-based authentication between VeloCloud Edge and VCO is enabled.
• The attacker holds the public portion of an Edge authentication certificate.
• The VCO web UI is reachable over the network.

No tenant credentials. No operator login. The public half of a certificate that was never meant to be a secret is enough to walk into privileged functionality. That is the whole shape of the bug: the orchestrator trusted a value that any Edge, and anyone who has seen an Edge's certificate, can present. BleepingComputer's report confirms the attack is low-complexity, requires no privileges and no user interaction, and was already being used in the wild when the advisory landed on 23 September.

Why losing the orchestrator is worse than losing an edge

Defenders instinctively rank a bug by where it sits. A VPN concentrator, a firewall, a mail gateway — each is bad. An SD-WAN orchestrator is a different category, because it is the thing that tells the edges what to do.

Arista is explicit that a compromised VCO "may allow access to managed VeloCloud Edge devices." Read operationally, that means the blast radius is not one host. It is:

• Every branch and remote site whose Edge trusts this orchestrator for policy.
• The overlay routing itself — traffic-steering rules, security policy, tunnel endpoints — all editable from the control plane.
• A pivot into the underlay, because the orchestrator sits in a management segment with reach into places a branch router never gets.

This is a repeat pattern, not a novelty. The SD-WAN management plane has been a magnet for unauthenticated bugs for years — Cisco's SD-WAN vManage, the same architectural role in a different vendor's stack, carried a string of unauthenticated remote-code-execution and information-disclosure CVEs across its lifetime. Concentrate control over hundreds of sites into one internet-adjacent web app and you have built the single most valuable target in the network. CVE-2026-93952 is that lesson arriving again.

The detection problem: a rooted orchestrator writes its own logs

Here is the part most write-ups skip. Arista published concrete indicators — and they matter — but you have to understand why they are only half the story.

The advisory lists a backdoor toolkit dropped on compromised hosts:

Indicator	Type
/usr/local/sbin/.vcnode.js	Hidden backdoor script
/usr/local/sbin/vc-sysmond	Rogue daemon binary
/etc/systemd/system/vc-sysmon.service	Persistence via systemd unit
142.93.149.77, 104.248.126.159	Attacker infrastructure
x-vc-opt header in nginx logs	Exploitation signal

Check for these now. But notice what they are: files on a box the attacker already roots, and log lines in a web server the attacker now controls.

"Grep the VCO for .vcnode.js and it comes back clean. Good news?" "Or the intruder had root for six hours and removed it before you looked. The absence of an artifact on a compromised host is not evidence of anything."

Once an attacker reaches privileged internal functionality on the orchestrator, the host's own telemetry becomes an adversary statement, not a witness. The nginx access log with the x-vc-opt header is genuinely useful — until the intruder edits it. The systemd unit is a real IOC — until it is renamed. Every on-box signal in that table has the same weakness: it lives on the machine the attacker owns.

What the attacker cannot rewrite is the network. A freshly-owned orchestrator that starts beaconing to 142.93.149.77, that opens an interactive session outbound to an ASN it has never contacted, that suddenly pushes configuration to edges at a cadence no change window explains, or that enrolls an Edge nobody provisioned — all of that is visible on the wire while it is happening, and the wire copy is not the intruder's to edit. That is the honest witness in an SD-WAN auth-bypass compromise: not the appliance's self-report, but the traffic the appliance generates.

Remediation

A complete runbook, in the order you should work it. Verify every version string against Arista SA-0183 for your exact train before acting.

1. Am I affected? You are running an exposed, vulnerable VCO On-Prem if your build is at or below any of these and the web UI is reachable from an untrusted network:

• 5.2.3.15 and below (5.2.x train)
• 6.1.3.7 and below (6.1.x train)
• 6.4.2.7 and below (6.4.x train)
• 7.0.0.2 and below (7.0.x train)

Confirm your version in the VCO UI or on the host, and confirm whether certificate-based Edge-to-VCO authentication is enabled — that is the exploit precondition. Arista's hosted (cloud) orchestrators were already patched; the exposure is On-Prem.

2. Patch — exact fixed versions. Arista confirms fixed builds:

• 5.2.3.16 and later in the 5.2.3 train
• 6.4.2.8 and later in the 6.4.2 train

Fixes for the 6.1.x and 7.0.x trains were being rolled out at disclosure — take the exact fixed build for your train directly from SA-0183, because "later" is not a version number.

3. Can't patch this hour? Compensating controls. The precondition is network reachability of the web UI, so remove it:

• Restrict the VCO web interface to a trusted administrative network — a management VLAN or a bastion, never the open internet.
• Front the UI with an allow-list at the load balancer or firewall; block the known attacker IPs 142.93.149.77 and 104.248.126.159 as a floor, not a fix.
• If your WAF can, virtual-patch the x-vc-opt request header and the anomalous encoded-path requests the advisory calls out.

4. Hunt for compromise. Map the hunt to the phases the attacker moves through:

• Initial access (ATT&CK T1190, exploit public-facing application): search nginx/web access logs for the x-vc-opt header, unusual URL path components, encoded characters, and internal-service references — dating back before your patch, not just after.
• Persistence (ATT&CK T1543.002, systemd service): check for /etc/systemd/system/vc-sysmon.service, the vc-sysmond daemon, and the hidden .vcnode.js script.
• Command and control: review outbound connections from the VCO host to the two listed IPs and to any ASN the orchestrator has no business reaching.
• Treat every on-box result as corroboration, not proof — pair it with an off-box record of the same activity.

5. Eradicate and verify. If you find evidence of compromise, patching is not remediation. The orchestrator held privileged reach into every managed Edge, so assume that reach was used:

• Rebuild the orchestrator from a known-good image rather than cleaning it in place — a rooted host is not trustworthy to attest its own cleanliness.
• Rotate every credential and certificate the VCO could touch, including Edge enrollment material, API tokens and operator accounts.
• Audit recent administrative activity and configuration pushes for changes that do not map to a change ticket, then confirm each managed Edge is running the policy you intend — not the policy an intruder left.

Where Zero Hunt fits

The defining problem in this incident is not the patch — it is that the compromised device is the one you were relying on to tell you it was compromised. When the orchestrator writes its own logs, the only account you can trust is the one taken off the wire.

That is the case Zero Hunt's AI Traffic Analysis was built for. A proprietary deep-learning model with four parallel inference heads — suspicious traffic, malware classification, attack-type identification and application fingerprinting — runs at 2.7+ Gbit/s on the appliance GPU, on-premise, with no customer data sent to any cloud. Because the application-fingerprinting head knows what normal VCO and Edge traffic looks like, an interactive shell leaving the orchestrator, a beacon to a never-seen ASN, or an out-of-pattern config push to the SD-WAN fabric surfaces while it is happening — not in the next morning's SIEM digest, and not from a log the intruder already edited.

The reachability question sits upstream of that, and it is where the second pillar answers. CVSS 10.0 scores the bug; it does not tell you whether your VCO web UI is actually reachable from the segment an attacker would start on, or whether the Edge certificate they'd need is exposed. Zero Hunt runs that as an autonomous AI red team on private models: a 10-agent swarm takes a realistic foothold and proves whether the auth bypass lands on your build and topology, with each finding backtested in the AI Gym before it runs and signed at write time (Ed25519, hash-chained) so the evidence — the orchestrator was reachable from here, and this is what it exposed — is verifiable rather than asserted. A human approves the actions that matter. Because an SD-WAN orchestrator carries regulated traffic, that same evidence maps once across the frameworks that apply — NIS2 and DORA in the EU among the 34 covered — instead of being reconstructed for each audit after the fact.