{"id":3057,"date":"2026-09-22T15:01:53","date_gmt":"2026-09-22T15:01:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3057"},"modified":"2026-09-22T15:01:53","modified_gmt":"2026-09-22T15:01:53","slug":"new-cvss-10-0-velocloud-orchestrator-flaw-actively-exploited-in-certificate-based-setups","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3057","title":{"rendered":"New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Sep 22, 2026<\/span><\/span>Vulnerability \/ Network Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22.<\/p>\n

The flaw, tracked as CVE-2026-93952<\/b>, may allow a remote attacker with no login access to privilege internal functions and affect the VCO host. Only orchestrators set up to authenticate their Edges with certificates are exposed.<\/p>\n

As of September 22, fixed releases<\/a> are out for the 5.2 and 6.4 release trains, but not yet for the 6.1 and 7.0 trains. Arista has already patched the Hosted and Dedicated versions of VCO. The affected releases include those that fixed a different VCO flaw, which Arista reported as exploited in July.<\/p>\n

Arista gave the flaw a CVSS 3.1 score of 10.0. A successful attack may compromise the orchestrator and the data it manages. A compromised VCO may also give attackers access to the Edge devices it manages.<\/p>\n

Arista said the flaw \u00abwas discovered externally and is known to be actively exploited.\u00bb It did not say when the attacks began or how widespread they are. The Hacker News has contacted Arista for comment.<\/p>\n

Which Deployments Are Exposed<\/h3>\n

VeloCloud Edges can authenticate to the orchestrator in one of three modes<\/a>. In Certificate Deactivated mode, an Edge uses a pre-shared key (PSK). In Certificate Acquire and Certificate Required modes, it uses a certificate issued by the orchestrator.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Arista said an orchestrator is exposed if \u00abcertificate based authentication from the VeloCloud Edge to VeloCloud Orchestrator (VCO) is configured.\u00bb It did not say which of those modes meets that condition. The attacker also needs network access to the VCO web interface and the public part of an Edge’s authentication certificate.<\/p>\n

The July flaw did not depend on settings: VCO was exposed to it by default, and no configuration could prevent that.<\/p>\n

<\/p>\n

Fixed Releases<\/h3>\n

As of September 22, these are the affected releases in each train, the releases that fix them, and the releases that fixed the July flaw:<\/p>\n\n\n\n\n\n\n\n
\n Train\n <\/th>\n\n Affected by CVE-2026-93952\n <\/th>\n\n Fixed in\n <\/th>\n\n July flaw (CVE-2026-16812) fixed in\n <\/th>\n<\/tr>\n
\n 5.2\n <\/td>\n\n 5.2.3.15 and earlier\n <\/td>\n\n 5.2.3.16 and later\n <\/td>\n\n 5.2.3.14\n <\/td>\n<\/tr>\n
\n 6.1\n <\/td>\n\n 6.1.3.7 and earlier\n <\/td>\n\n No fix yet\n <\/td>\n\n 6.1.3.4\n <\/td>\n<\/tr>\n
\n 6.4\n <\/td>\n\n 6.4.2.7 and earlier\n <\/td>\n\n 6.4.2.8 and later\n <\/td>\n\n 6.4.2.4\n <\/td>\n<\/tr>\n
\n 7.0\n <\/td>\n\n 7.0.0.2 and earlier\n <\/td>\n\n No fix yet\n <\/td>\n\n No fix listed. 7.0.0.1 and later were not affected.\n <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Arista said fixes for affected trains that are still supported are coming and will be added to its advisory when ready. Customers on an unsupported release train can contact Arista’s Technical Assistance Center (TAC) about upgrade options.<\/p>\n

If You Cannot Upgrade Yet<\/h3>\n

Until a fixed release is installed, Arista recommends these steps:<\/p>\n