Arista VeloCloud Orchestrator CVE-2026-93952: Active Exploitation of Authentication Bypass Zero-Day

1. Basic Information

• Title: Security Advisory 0183
• Published: 2026-09-22
• Updated: 2026-09-23
• Collected: 2026-09-24T08:09:37+09:00
• Source: Arista
• Severity: critical
• Type: Threat Intelligence
• Target Period: 2026-09-23T08:14:06+09:00 - 2026-09-24T08:09:37+09:00 (Asia/Tokyo)
• Original: Security Advisory 0183
• Related Source: BleepingComputer: Arista patches actively exploited VeloCloud Orchestrator zero-day
• Severity Basis: Can be exploited before authentication with a CVSS v3.1 score of 10.0. Arista has confirmed active exploitation and released indicators of compromise including backdoor-related files and systemd services on the VCO.
• Update Reason: Verified with primary sources, organized update dates, patch levels by product line, observed indicators of compromise, and unconfirmed downstream impacts.

2. Executive Summary

Arista has confirmed active exploitation of an authentication bypass vulnerability in VeloCloud Orchestrator (VCO) and released indicators of compromise such as backdoor-related files. Exploitation requires the public portion of the Edge authentication certificate and network reachability to the VCO Web UI.

3. Attack Flow

Conditions for Authentication Bypass and Artifacts to Investigate After Compromise

1. An attacker obtains the public portion of an Edge authentication certificate associated with an unpatched VCO that has certificate-based Edge-to-VCO authentication enabled.
2. If the VCO Web UI is reachable, the attacker can access privileged internal functions without tenant or operator credentials and impact the VCO host.
3. Arista has published .vcnode.js, vc-sysmond, vc-sysmon.service, the x-vc-opt header, and source IPs as indicators related to active exploitation. The specific deployment order and header processing details have not been disclosed.
4. Inference: Investigate potential impact spreading to credentials, configurations, and managed Edges following a compromise. Data theft and lateral movement to Edges are unconfirmed publicly.

4. Attacker Position and Execution Location

• External attackers with network reachability to the VCO Web UI from the internet or a management network
• Entities capable of acquiring the public portion of the Edge certificate
• Operators executing commands on the VCO host after compromise

5. Visibility for Victims and Administrators

Victims

• SD-WAN users may not notice direct anomalies

Administrators and SOCs

• Potential presence of known JavaScript files, backdoors, and systemd services
• The x-vc-opt header in nginx logs
• Management plane connections from known IPs
• Inference: Configurations, credentials, and managed Edge state changes that do not match administrator actions

6. Success and Failure Conditions

Success Conditions

• Certificate-based Edge-to-VCO authentication is enabled
• The attacker obtains the public portion of the Edge certificate
• Network reachability to the VCO Web UI
• Using an unpatched version

Failure Conditions and Mitigations

• Update to version 5.2.3.16 or later (5.2.3 branch) or 6.4.2.8 or later (6.4.2 branch). For other branches, consult TAC to confirm patched versions and migration paths.
• Restrict the VCO Web UI to trusted management networks or VPNs
• Block traffic associated with known malicious IPs and eliminate unnecessary network exposure
• If compromise is suspected, preserve evidence, contact Arista TAC, recover from a trusted environment, and determine whether to rotate and revoke exposed credentials.

7. What Happens Upon Success

• Authentication bypass to privileged internal functions and compromise of the VCO host
• Deployment of backdoors and persistence configurations (related indicators of compromise published by Arista)
• Inference: Potential leakage or tampering of SD-WAN configurations, credentials, and Edge information, as well as impacts on managed devices.

8. Observable Logs

Email

• No email vectors reported

Proxy / SWG / DNS

• Suspicious requests to the VCO Web UI
• Incoming connections to the VCO from known malicious source IPs: 142.93.149.77 and 104.248.126.159

Endpoint / EDR

• /usr/local/sbin/.vcnode.js
• /usr/local/sbin/vc-sysmond (MD5 dc78e206eaeadec59fc5801fe4556bd0)
• Creation and startup of /etc/systemd/system/vc-sysmon.service

Identity / IdP

• Management operations occurring without normal operator or tenant authentication records

SaaS / Cloud

• Hosted VCOs are handled by the vendor. For on-premises, check configuration exports, Edge status, and administrator audit logs

Network

• nginx request header x-vc-opt
• Communication from the VCO to unknown external hosts
• Abnormal connections from the VCO to Edges or management networks

9. Attack Success Determination

Confirmed via Public Information

• Subsequent Compromise Confirmed: Public info: Arista has confirmed active exploitation and published indicators of compromise regarding malicious files, systemd services, and traffic on the VCO. Commands executed in individual environments, stolen data, and the scope of managed Edge compromise have not been publicly confirmed. Scope: VCO indicators published by Arista. Does not imply installation in all affected environments.

10. Investigation Playbook

Trigger

• Presence of the affected version, known files, services, headers, or IPs

Initial Checks

• Check version, deployment format, certificate authentication settings, and Web UI exposure
• Preserve web access, backend, system, database logs, and file timestamps before recovery.

Endpoints and Servers

• Investigate the three known paths, hashes, processes, process lineage, persistence, and additional files
• Check command history and outbound communication during the backdoor execution period

Authentication and Cloud

• Check credentials and certificate usage history for VCO administrators, tenants, and Edges
• Mark API tokens, backups, and integration secrets for rotation and revocation

Subsequent Operations

• Compare changes in Edge settings, routing, firewall and VPN policies, and firmware distribution
• Check for lateral movement within the management network

Containment

• Isolate the VCO from the management network and rebuild/restore according to vendor procedures
• Update to a patched version, and rotate or revoke credentials and certificates
• Deploy IoCs to network and EDR tools

Decision Criteria

• Do not assume successful compromise based on suspicious requests alone; cross-reference known file contents, hashes, service configurations, and execution logs. If IoCs match, preserve state and contact Arista TAC.

11. Defense and Detection Ideas

Single Event

• VCO requests containing the x-vc-opt header
• Creation of known backdoor paths or services
• Connections to the VCO management plane from known IPs

Timeline Correlation

• Correlate Web UI requests without authentication records -> file creation -> systemd service activation -> outbound connections

Threat Hunting

• Search across the VCO for hidden files, unknown services, and recent modifications in /usr/local/sbin

Log Gaps

• If shell and EDR observability is lacking on the appliance, packet capture and vendor support diagnostic data are required

Priority Mitigations

• Emergency update to patched versions corresponding to the deployment branch
• Restrict connection sources to the management UI
• Immutable backups
• Rotate or revoke credentials and certificates based on exposure
• File integrity monitoring for the appliance

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-93952 is an input validation flaw in VeloCloud Orchestrator, rated 10.0 for CVSS v3.1 and 9.5 for CVSS v4.0.
• It can be exploited without operator or tenant credentials if certificate-based Edge-to-VCO authentication is enabled, the public portion of the Edge certificate is obtained, and the VCO Web UI is reachable.
• Arista has confirmed active exploitation, hosted VCOs have been patched, and on-premises users are urged to update and investigate compromises.
• Affected ranges are 5.2.3.15 and earlier for the 5.2.x branch, 6.1.3.7 and earlier for the 6.1.x branch, 6.4.2.7 and earlier for the 6.4.x branch, and 7.0.0.2 and earlier for the 7.0.x branch.
• Patched versions are 5.2.3.16 and later for the 5.2.3 branch, and 6.4.2.8 and later for the 6.4.2 branch. Additional patched versions for other affected branches are scheduled for release, and update paths must be confirmed with Arista TAC.
• Malicious files .vcnode.js, vc-sysmond, vc-sysmon.service, nginx header x-vc-opt, and IPs 142.93.149.77 and 104.248.126.159 have been published as IoCs.

Inference

• VCO compromise can expand impact to individual Edge settings, credentials, and SD-WAN configurations; remediation should not stop at a single host.
• Because public certificate portions are sufficient and private key theft is not required, reducing the exposure surface of Edge certificates and management UI reachability is critical.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	Exploiting authentication bypass in the VCO Web UI.
T1543.002	Create or Modify System Process: Systemd Service	high	Persistence via vc-sysmon.service.

14. Unknowns and Further Investigation

• Full pattern of initial intrusion requests
• Number of compromised organizations and duration of activity
• Commands executed by the backdoor and data stolen
• Release schedules for patched versions of the affected 6.1.x and 7.0.x branches
• Presence of configuration tampering down to the Edge level
• Persistence methods other than public IoCs and specific processing of the x-vc-opt header

15. Impact on SOCs and Organizations

Organizations utilizing on-premises VCOs must verify not only updates but also known IoCs, management audit records, and Edge configuration diffs. Because SD-WAN management planes can span all branch sites, handle matching IoCs as a wide-area network incident.

16. Summary by Persona

SOC

Cross-reference VCO headers, files, systemd, and network IoCs, and investigate potential Edge configuration changes.

Administrators

Restrict reachability to the Web UI, update to patched versions, and if compromise is suspected, preserve evidence before rebuilding and rotating or revoking credentials.

General Users

No direct remediation is required of end users, but report any communication disruptions or VPN changes to the IT support team.