---
title: "Arista VeloCloud Orchestrator: Two Exploited CVSS 10 Flaws"
url: https://erroneo.us/security/briefs/arista-velocloud-orchestrator-cve-2026-16812-93952-exploited-rce/
description: "Two exploited, unauthenticated flaws in on-prem VeloCloud Orchestrator. Both fixed in 5.2.3.16 and 6.4.2.8; 6.1 and 7.0 still lack a fix for the second."
type: security-brief
section: "Security Digest"
date_published: 2026-07-27
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-16812", "CVE-2026-93952"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Arista VeloCloud Orchestrator: Two Exploited CVSS 10 Flaws

**Verdict: Act now.** On-prem VCO operators should move to 5.2.3.16 or 6.4.2.8 now, lock the web interface down and hunt for the published backdoor files; both flaws are exploited, and the July fixes do not cover the September bug.

- **Who must act:** Anyone running VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom) on the 5.2, 6.1, 6.4 or 7.0 trains, most urgently where the web interface is internet-reachable or Edge certificate authentication is enabled.
- **Who can relax:** Customers on Arista Hosted or Dedicated VCO, which Arista patched itself; VeloCloud Edges and Gateways are listed as not affected.
- **Affected:** VCO On-Prem 5.2.x before 5.2.3.14 (CVE-2026-16812); 5.2.3.15 and below (CVE-2026-93952); VCO On-Prem 6.1.x before 6.1.3.4 (CVE-2026-16812); 6.1.3.7 and below (CVE-2026-93952); VCO On-Prem 6.4.x before 6.4.2.4 (CVE-2026-16812); 6.4.2.7 and below (CVE-2026-93952); VCO On-Prem 7.0.x before 7.0.0.1 (CVE-2026-16812); 7.0.0.2 and below (CVE-2026-93952); End-of-support releases: not assessed by Arista
- **Fixed:** VCO 5.2.3.16 (both CVEs); VCO 6.4.2.8 (both CVEs); VCO 6.1.3.4 and 7.0.0.1 fix CVE-2026-16812 only; no CVE-2026-93952 fix listed for 6.1 or 7.0 as of Oct 21, 2026
- **CVEs:** CVE-2026-16812, CVE-2026-93952
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every on-prem VCO and its exact release; anything at or below 5.2.3.15, 6.1.3.7, 6.4.2.7 or 7.0.0.2 is exposed to at least one exploited flaw.
2. Upgrade to 5.2.3.16 or 6.4.2.8 or later; on 6.1, 7.0 or an unsupported train, contact Arista TAC for an upgrade path.
3. Restrict the VCO web interface to trusted administrative networks and block outbound ports the VCO host does not need.
4. Block and search logs for 8.19.75.217, 206.72.242.124, 206.72.242.162, 142.93.149.77 and 104.248.126.159.
5. Preserve web, application, system and database logs and file timestamps before any rebuild.
6. If compromised, rebuild the orchestrator from trusted sources, rotate credentials and validate the state of every managed Edge.

### How to check if you are affected

- Check the VCO host for /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond (MD5 dc78e206eaeadec59fc5801fe4556bd0) and /etc/systemd/system/vc-sysmon.service.
- Search nginx logs for the x-vc-opt HTTP header and for requests from the five source IPs Arista lists.
- Review web logs for unusual URL-like path components, encoded characters, references to local or internal services, and high request rates.
- Look for unexpected outbound HTTP(S) from the VCO host, database exports or archives, and configuration changes without matching admin activity.

## What happened

Arista has disclosed two actively exploited, maximum-severity flaws in VeloCloud Orchestrator (VCO) On-Prem, the management plane for VeloCloud SD-WAN, which its advisories describe as "formerly VeloCloud Orchestrator by Broadcom." Arista says both were "discovered externally" and are "known to be actively exploited." Either one may let a remote attacker "access privileged internal functionality and impact the VCO host."

On July 27, 2026, [Security Advisory 0144](https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144) disclosed [CVE-2026-16812](https://www.cve.org/CVERecord?id=CVE-2026-16812), an OS command injection (CWE-78) scored CVSS 3.1 10.0. The function involved "was intended to be for internal use only." In Arista's words: "VCO is exposed by default. There is no configuration that can prevent the exposure." No tenant or operator credentials are needed. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812) the same day, due July 30.

On September 22, [Security Advisory 0183](https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183) disclosed [CVE-2026-93952](https://www.cve.org/CVERecord?id=CVE-2026-93952), an improper input validation flaw (CWE-20) scored CVSS 3.1 10.0 and CVSS 4.0 9.5. It applies when "certificate based authentication from the VeloCloud Edge to VeloCloud Orchestrator (VCO) is configured." The attacker needs the public portion of an Edge authentication certificate and network access to the web interface, but no credentials. As [The Hacker News](https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html) pointed out, the affected ranges include the builds that fixed CVE-2026-16812. CISA added this one to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952) the same day, due September 25. This time Arista published host indicators: a hidden `.vcnode.js`, a `vc-sysmond` daemon and a systemd unit.

## Who is affected

Only VCO On-Prem needs customer action. Arista says it has patched its Hosted and Dedicated instances itself: advisory 0183 says they have "already been patched," while 0144 said they were "being actively patched." VeloCloud Edge and Gateway are listed as not affected, and Arista did not assess end-of-support releases.

| Train | CVE-2026-16812 fixed in | CVE-2026-93952 affected | CVE-2026-93952 fixed in |
|---|---|---|---|
| 5.2 | 5.2.3.14 | 5.2.3.15 and below | 5.2.3.16 |
| 6.1 | 6.1.3.4 | 6.1.3.7 and below | not listed |
| 6.4 | 6.4.2.4 | 6.4.2.7 and below | 6.4.2.8 |
| 7.0 | 7.0.0.1 | 7.0.0.2 and below | not listed |

As of Oct 21, 2026, advisory 0183 (last revised September 23) still says fixes for other trains "will be added over time."

## Do you really need to act?

Yes. CVE-2026-16812 needs nothing more than network access to a default VCO, and CISA rates both flaws automatable with total technical impact. The orchestrator holds the device inventory, credentials, certificates and key material for your SD-WAN. Arista warns that "Compromises to the VCO platform may allow attackers access to the VeloCloud Edge devices as well."

A July upgrade does not protect you from the September bug. On 6.1 or 7.0 with Edge certificate authentication, your train has no fixed build, and [Network World](https://www.networkworld.com/article/4226139/on-prem-velocloud-orchestrator-under-attack-only-some-versions-patched.html) quotes a Qualys researcher saying unpatched versions "have only compensating controls as a protection." Arista says restricting the web interface to trusted admin networks "can reduce risk of exposure." Ask TAC about moving to 5.2.3.16 or 6.4.2.8.

## What to do now

1. Inventory every on-prem VCO and its exact release.
2. Upgrade to 5.2.3.16 or 6.4.2.8 or later. On 6.1, 7.0 or an unsupported train, contact Arista TAC.
3. Restrict the VCO web interface to trusted administrative networks, and block outbound ports the VCO host does not need.
4. Block the five published source IPs: `8.19.75.217`, `206.72.242.124`, `206.72.242.162`, `142.93.149.77` and `104.248.126.159`.
5. Before any rebuild, preserve web access, application, system and database logs and file-system timestamps, as Arista asks.
6. If compromised, rebuild the orchestrator from trusted sources, rotate credentials, review admin activity and validate the state of every managed Edge.

## How to tell if you were hit

On the VCO host, run `ls -la /usr/local/sbin/.vcnode.js /usr/local/sbin/vc-sysmond /etc/systemd/system/vc-sysmon.service` and `systemctl status vc-sysmon`. If `vc-sysmond` exists, check it with `md5sum` against the hash Arista lists, `dc78e206eaeadec59fc5801fe4556bd0`. Search nginx logs for the `x-vc-opt` header and for the five IPs. Arista says there is no single definitive indicator, so also look for:

- unusual URL-like path components, encoded characters, references to local or internal services, and high request rates in web logs;
- unexpected outbound HTTP(S) from the VCO host;
- database exports or archive files;
- configuration changes that do not match admin activity.

The September indicators may not cover intrusions that used the July bug. If your VCO was exposed and unpatched in July, a clean result does not rule out compromise.

## Timeline

- Jul 27, 2026 — Arista publishes Advisory 0144 (CVE-2026-16812) and states it is actively exploited. CISA adds it to KEV.
- Jul 30, 2026 — CISA's deadline for CVE-2026-16812.
- Aug 3, 2026 — Advisory 0144 is revised to add VeloCloud Orchestrator Hosted to the affected platforms.
- Sep 22, 2026 — Arista publishes Advisory 0183 (CVE-2026-93952) with fixes for the 5.2 and 6.4 trains only, plus host IOCs. CISA adds it to KEV.
- Sep 25, 2026 — CISA's deadline for CVE-2026-93952.

## Sources

1. [Arista — Security Advisory 0144 (CVE-2026-16812)](https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144)
2. [Arista — Security Advisory 0183 (CVE-2026-93952)](https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183)
3. [CVE record — CVE-2026-16812](https://www.cve.org/CVERecord?id=CVE-2026-16812)
4. [CVE record — CVE-2026-93952](https://www.cve.org/CVERecord?id=CVE-2026-93952)
5. [NVD — CVE-2026-16812](https://nvd.nist.gov/vuln/detail/CVE-2026-16812)
6. [NVD — CVE-2026-93952](https://nvd.nist.gov/vuln/detail/CVE-2026-93952)
7. [CISA — Known Exploited Vulnerabilities: CVE-2026-16812](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812)
8. [CISA — Known Exploited Vulnerabilities: CVE-2026-93952](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952)
9. [Network World — On-prem VeloCloud Orchestrator under attack, only some versions patched](https://www.networkworld.com/article/4226139/on-prem-velocloud-orchestrator-under-attack-only-some-versions-patched.html)
10. [SecurityWeek — Critical Arista VeloCloud Orchestrator vulnerability exploited as zero-day](https://www.securityweek.com/critical-arista-velocloud-orchestrator-vulnerability-exploited-as-zero-day/)
11. [The Hacker News — New CVSS 10.0 VeloCloud Orchestrator flaw](https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html)

---
Source page: https://erroneo.us/security/briefs/arista-velocloud-orchestrator-cve-2026-16812-93952-exploited-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt