CVE-2026-93952

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-93952 10.0

Arista · VeloCloud Orchestrator · Added 2026-09-22 · Published 2026-09-22

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityArista VeloCloud Orchestrator Improper Input Validation Vulnerability

VendorArista

ProductVeloCloud Orchestrator

Date added2026-09-22

Due date2026-09-25

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-20

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

NVD: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-22 20:15 UTC

Wall time0.5s

Searches4

Component defaultno

Sources https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
https://securityonline.info/velocloud-vulnerability-cve-2026-93952/
https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html
https://www.cybernewsai.com/blog/velocloud-cvss-10-cve-2026-93952-actively-exploited
https://ccb.belgium.be/advisories/warning-velocloud-orchestrator-improper-input-validation-vulnerability-patch-immediately
https://vuldb.com/vuln/408362

Hunting hypothesis agent

Hunt VCO nginx access logs for requests with the x-vc-opt header or unusual path components; check system logs for hidden files .vcnode.js and vc-sysmond, and outbound connections to C2 IPs 142.93.149.77 or 104.248.126.159.

Research details

ComponentNginx front-end request routing and authentication handler in VCO web interface

PreconditionsCertificate-based authentication from VeloCloud Edge to VCO must be configured (Certificate Acquire or Certificate Required mode); attacker needs network access to VCO web interface on TCP/443; attacker needs the public portion of a valid Edge authentication certificate; VCO or operator credentials are NOT required; affected versions include VCO 5.2.3.15 and below, 6.1.3.7 and below, 6.4.2.7 and below, and 7.0.0.2 and below. agent

DeliveryHTTPS requests with x-vc-opt header and malformed path components to the VCO web interface

Public PoCno

Advisoryhttps://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183

Exploit notesNo public proof-of-concept exists, but exploitation is confirmed active in the wild by Arista. Attack complexity is LOW per CVSS (AC:L). The flaw is in VCO Nginx front-end input validation: by injecting a custom HTTP header (x-vc-opt) alongside malformed path components and certificate metadata, the attacker induces parser desynchronization to bypass authentication handlers and access privileged internal APIs. Post-exploitation leaves backdoor artifacts at /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond, and /etc/systemd/system/vc-sysmon.service with known C2 IPs 142.93.149[.]77 and 104.248.126[.]159.

SummaryArista VeloCloud Orchestrator (VCO) on-prem versions 5.2.3.15 and below, 6.1.3.7 and below, 6.4.2.7 and below, and 7.0.0.2 and below contain an improper input validation flaw (CWE-20) in the Nginx front-end request routing that enables unauthenticated remote attackers to bypass authentication and access privileged internal functionality when certificate-based Edge authentication is configured. The flaw is actively exploited in the wild with confirmed post-exploitation backdoor deployment; CVSS 10.0. Fixes are available for 5.2.x (5.2.3.16) and 6.4.x (6.4.2.8) trains; patches for 6.1.x and 7.0.x are pending.

Tia coverage

First reported2026-09-09

First exploit report2026-09-22

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

an-exploited-velocloud-vulnerability-with-a-10-0-cvss-score-hits cisa-2026-0908-cisa-adds-4-known-exploited-vulnerabilities-to-ca

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.