CVE-2026-93952: Arista VeloCloud Orchestrator — SD-WAN Control at Risk (June 2024)

CVE-2026-93952 — Arista VeloCloud Orchestrator

CVE-2026-93952 is a critical vulnerability in Arista's on-premises VeloCloud Orchestrator (VCO) that allows remote attackers to bypass authentication via a CSRF flaw. The vulnerability is under active exploitation, enabling adversaries to seize control of SD-WAN edge devices and manipulate credentials and device states. Severity is critical; immediate action is required.

Attack Vector

Attackers exploit a CSRF vulnerability in the VCO web interface under specific configuration conditions. By crafting malicious requests, adversaries can bypass authentication and execute privileged actions. Indicators of compromise include the presence of a suspicious 'vc-sysmond' file, the 'x-vc-opt' HTTP header in traffic, and activity from two known malicious source IP addresses. Exploitation enables attackers to rotate credentials, alter device states, and potentially disrupt or reroute SD-WAN traffic across managed sites.

Who Is at Risk

The vulnerability affects Arista's on-premises VeloCloud Orchestrator deployments. Hosted and dedicated VCO environments have received patches, but some on-prem versions remain unpatched and exposed. Organizations running unpatched on-prem VCOs are at immediate risk of compromise. Arista customers should verify their deployment type and patch status without delay.

Patch & Mitigate

• Patch: Apply the latest Arista VCO security update immediately. Confirm your on-prem version is not among those left unpatched.
• Workaround: No effective workaround is available; patching is mandatory.
• Detect: Monitor for the 'vc-sysmond' file on VCO hosts, inspect logs for the 'x-vc-opt' HTTP header, and review access logs for connections from the two identified malicious IPs. Audit for unauthorized credential changes or device state modifications.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit the CSRF flaw to gain unauthorized access to the VCO.
• TA0005 — Defense Evasion: Use of crafted HTTP headers and files to evade detection and maintain persistence.
• TA0006 — Credential Access: Attackers rotate or steal credentials to expand control within the SD-WAN environment.

Source: https://www.csoonline.com/article/4226148/on-prem-velocloud-orchestrator-under-attack-only-some-versions-patched-2.html