Arista VeloCloud Orchestrator: Two Exploited CVSS 10 Flaws

What to do

Inventory every on-prem VCO and its exact release; anything at or below 5.2.3.15, 6.1.3.7, 6.4.2.7 or 7.0.0.2 is exposed to at least one exploited flaw.
Upgrade to 5.2.3.16 or 6.4.2.8 or later; on 6.1, 7.0 or an unsupported train, contact Arista TAC for an upgrade path.
Restrict the VCO web interface to trusted administrative networks and block outbound ports the VCO host does not need.
Block and search logs for 8.19.75.217, 206.72.242.124, 206.72.242.162, 142.93.149.77 and 104.248.126.159.
Preserve web, application, system and database logs and file timestamps before any rebuild.
If compromised, rebuild the orchestrator from trusted sources, rotate credentials and validate the state of every managed Edge.

How to check if you are affected or compromised

Check the VCO host for /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond (MD5 dc78e206eaeadec59fc5801fe4556bd0) and /etc/systemd/system/vc-sysmon.service.
Search nginx logs for the x-vc-opt HTTP header and for requests from the five source IPs Arista lists.
Review web logs for unusual URL-like path components, encoded characters, references to local or internal services, and high request rates.
Look for unexpected outbound HTTP(S) from the VCO host, database exports or archives, and configuration changes without matching admin activity.

What happened#

Arista has disclosed two actively exploited, maximum-severity flaws in VeloCloud Orchestrator (VCO) On-Prem, the management plane for VeloCloud SD-WAN, which its advisories describe as "formerly VeloCloud Orchestrator by Broadcom." Arista says both were "discovered externally" and are "known to be actively exploited." Either one may let a remote attacker "access privileged internal functionality and impact the VCO host."

On July 27, 2026, Security Advisory 0144 disclosed CVE-2026-16812, an OS command injection (CWE-78) scored CVSS 3.1 10.0. The function involved "was intended to be for internal use only." In Arista's words: "VCO is exposed by default. There is no configuration that can prevent the exposure." No tenant or operator credentials are needed. CISA added it to the KEV catalog the same day, due July 30.

On September 22, Security Advisory 0183 disclosed CVE-2026-93952, an improper input validation flaw (CWE-20) scored CVSS 3.1 10.0 and CVSS 4.0 9.5. It applies when "certificate based authentication from the VeloCloud Edge to VeloCloud Orchestrator (VCO) is configured." The attacker needs the public portion of an Edge authentication certificate and network access to the web interface, but no credentials. As The Hacker News pointed out, the affected ranges include the builds that fixed CVE-2026-16812. CISA added this one to KEV the same day, due September 25. This time Arista published host indicators: a hidden .vcnode.js, a vc-sysmond daemon and a systemd unit.

Who is affected#

Only VCO On-Prem needs customer action. Arista says it has patched its Hosted and Dedicated instances itself: advisory 0183 says they have "already been patched," while 0144 said they were "being actively patched." VeloCloud Edge and Gateway are listed as not affected, and Arista did not assess end-of-support releases.

Train	CVE-2026-16812 fixed in	CVE-2026-93952 affected	CVE-2026-93952 fixed in
5.2	5.2.3.14	5.2.3.15 and below	5.2.3.16
6.1	6.1.3.4	6.1.3.7 and below	not listed
6.4	6.4.2.4	6.4.2.7 and below	6.4.2.8
7.0	7.0.0.1	7.0.0.2 and below	not listed

As of Oct 21, 2026, advisory 0183 (last revised September 23) still says fixes for other trains "will be added over time."

Do you really need to act?#

Yes. CVE-2026-16812 needs nothing more than network access to a default VCO, and CISA rates both flaws automatable with total technical impact. The orchestrator holds the device inventory, credentials, certificates and key material for your SD-WAN. Arista warns that "Compromises to the VCO platform may allow attackers access to the VeloCloud Edge devices as well."

A July upgrade does not protect you from the September bug. On 6.1 or 7.0 with Edge certificate authentication, your train has no fixed build, and Network World quotes a Qualys researcher saying unpatched versions "have only compensating controls as a protection." Arista says restricting the web interface to trusted admin networks "can reduce risk of exposure." Ask TAC about moving to 5.2.3.16 or 6.4.2.8.

What to do now#

Inventory every on-prem VCO and its exact release.
Upgrade to 5.2.3.16 or 6.4.2.8 or later. On 6.1, 7.0 or an unsupported train, contact Arista TAC.
Restrict the VCO web interface to trusted administrative networks, and block outbound ports the VCO host does not need.
Block the five published source IPs: 8.19.75.217, 206.72.242.124, 206.72.242.162, 142.93.149.77 and 104.248.126.159.
Before any rebuild, preserve web access, application, system and database logs and file-system timestamps, as Arista asks.
If compromised, rebuild the orchestrator from trusted sources, rotate credentials, review admin activity and validate the state of every managed Edge.

How to tell if you were hit#

On the VCO host, run ls -la /usr/local/sbin/.vcnode.js /usr/local/sbin/vc-sysmond /etc/systemd/system/vc-sysmon.service and systemctl status vc-sysmon. If vc-sysmond exists, check it with md5sum against the hash Arista lists, dc78e206eaeadec59fc5801fe4556bd0. Search nginx logs for the x-vc-opt header and for the five IPs. Arista says there is no single definitive indicator, so also look for:

unusual URL-like path components, encoded characters, references to local or internal services, and high request rates in web logs;
unexpected outbound HTTP(S) from the VCO host;
database exports or archive files;
configuration changes that do not match admin activity.

The September indicators may not cover intrusions that used the July bug. If your VCO was exposed and unpatched in July, a clean result does not rule out compromise.

Timeline#

Jul 27, 2026 — Arista publishes Advisory 0144 (CVE-2026-16812) and states it is actively exploited. CISA adds it to KEV.
Jul 30, 2026 — CISA's deadline for CVE-2026-16812.
Aug 3, 2026 — Advisory 0144 is revised to add VeloCloud Orchestrator Hosted to the affected platforms.
Sep 22, 2026 — Arista publishes Advisory 0183 (CVE-2026-93952) with fixes for the 5.2 and 6.4 trains only, plus host IOCs. CISA adds it to KEV.
Sep 25, 2026 — CISA's deadline for CVE-2026-93952.

Vulnerability records

CVE-2026-16812 · KEV 2026-07-27 · VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact…
CVE-2026-93952 · KEV 2026-09-22 · VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

Arista — Security Advisory 0144 (CVE-2026-16812) arista.com
Arista — Security Advisory 0183 (CVE-2026-93952) arista.com
CVE record — CVE-2026-16812 cve.org
CVE record — CVE-2026-93952 cve.org
NVD — CVE-2026-16812 nvd.nist.gov
NVD — CVE-2026-93952 nvd.nist.gov
CISA — Known Exploited Vulnerabilities: CVE-2026-16812 cisa.gov
CISA — Known Exploited Vulnerabilities: CVE-2026-93952 cisa.gov
Network World — On-prem VeloCloud Orchestrator under attack, only some versions patched networkworld.com

Coverage and analysis

SecurityWeek — Critical Arista VeloCloud Orchestrator vulnerability exploited as zero-day securityweek.com
The Hacker News — New CVSS 10.0 VeloCloud Orchestrator flaw thehackernews.com