On September 22, Arista Networks disclosed a critical security vulnerability identified in the on-premises VeloCloud Orchestrator (VCO), a key component in managing VeloCloud SD-WAN devices. This vulnerability, cataloged as CVE-2026-93952, is reportedly being actively exploited by attackers. The flaw permits unauthorized access to internal functionalities, affecting orchestrators configured to authenticate Edges using certificates.
Implications of the Vulnerability
The flaw, rated with a CVSS 3.1 score of 10.0, underscores its severity and potential impact. When exploited, attackers can compromise the orchestrator, jeopardizing the data it manages and potentially gaining control over the network Edge devices. Arista has issued patches for some release versions, but updates for the 6.1 and 7.0 release trains remain pending.
Arista’s advisory highlights that orchestrators using certificate-based authentication for VeloCloud Edges are susceptible to this flaw. However, the exact modes of certificate-based authentication that expose the orchestrator were not detailed. The vulnerability requires network access to the VCO web interface and the public part of an Edge’s authentication certificate.
Current and Future Mitigation Measures
Arista has released fixes for specific versions within the 5.2 and 6.4 trains, but the 6.1 and 7.0 versions still await updates. The company assures that patches for supported trains will be announced in their security advisories. Customers operating unsupported versions are encouraged to consult Arista’s Technical Assistance Center (TAC) for upgrade options.
In the interim, Arista recommends several precautionary measures: restricting access to the VCO web interface to trusted networks, monitoring for known malicious IP addresses, and observing for unusual outbound network activity. It is also advised to block unnecessary outbound ports and monitor for signs of unauthorized access or modifications.
Identifying and Responding to Compromise
Detecting a breach through this vulnerability requires vigilance, as no singular indicator confirms exploitation. Review VCO web access logs for unusual activity, such as requests with atypical paths or high frequencies. Indicators include specific file modifications or the presence of certain IP addresses known to be associated with malicious activity.
Should any signs of compromise be observed, administrators are advised to preserve the system’s current state and contact Arista’s TAC for further instructions. After securing the system, an incident response protocol should be initiated, including credential rotation and a thorough review of the orchestrator’s and Edge devices’ integrity.
This vulnerability highlights the ever-evolving landscape of cybersecurity threats and the importance of timely updates and vigilant monitoring to protect network infrastructures.
