Unauthenticated access to privileged internal functions in on-prem VeloCloud Orchestrator (CVE-2026-93952)
Arista's advisory of 2026-09-22 confirms the flaw is being actively exploited and CISA added it to KEV the same day with a 2026-09-25 due date, so an unpatched on-prem orchestrator is a live path to compromise of the entire SD-WAN estate.
An improper input validation flaw in on-premises VeloCloud Orchestrator lets a remote attacker with no credentials reach privileged internal functionality and compromise the VCO host and the data it manages for every Edge in the SD-WAN. Arista rates it CVSS 3.1 10.0 with changed scope; hosted and dedicated VCO instances were already patched by Arista.
Affected: VeloCloud Orchestrator (VCO) On-Prem 5.2.0 through 5.2.3.15; VeloCloud Orchestrator (VCO) On-Prem 6.1.0 through 6.1.3.7; VeloCloud Orchestrator (VCO) On-Prem 6.4.0 through 6.4.2.7; VeloCloud Orchestrator (VCO) On-Prem 7.0.0 through 7.0.0.2
How to Test
Check the running VCO on-prem software version against the affected trains (5.2.x ≤ 5.2.3.15, 6.1.x ≤ 6.1.3.7, 6.4.x ≤ 6.4.2.7, 7.0.x ≤ 7.0.0.2); Arista states that a release not on this list is not vulnerable regardless of platform. Hosted/dedicated VCO customers are already patched by Arista. Review orchestrator access logs for unexpected unauthenticated requests to internal/privileged endpoints and audit for new or altered administrator accounts, Edge configurations and API tokens, following CISA's forensics triage guidance since exploitation is confirmed.
How to Patch
Upgrade on-prem VCO to a release newer than the affected ceiling in your train (above 5.2.3.15, 6.1.3.7, 6.4.2.7 or 7.0.0.2) per Arista Security Advisory 0183 (BUG1907167 / BUG1937417). Until upgraded, restrict network access to the orchestrator's management interface to trusted sources only.