Arista has published Security Advisory 0183 warning of a critical vulnerability in on-premises VeloCloud Orchestrator (VCO), tracked as CVE-2026-93952. The advisory, dated September 22, 2026, assigns the flaw a CVSS 3.1 base score of 10.0, indicating the highest level of severity. The issue is caused by improper input validation and is already being actively exploited, making immediate assessment and remediation essential for affected organisations.
The vulnerability could allow a remote, unauthenticated attacker to access privileged internal functionality and compromise the VCO host. Successful exploitation may affect the confidentiality, integrity and availability of the orchestrator, including data managed by it. Arista said the issue affects on-premises VCO deployments, while hosted and dedicated VCO versions have already been patched. The affected software includes VCO 5.2.3.15 and earlier in the 5.2.x series, 6.1.3.7 and earlier in the 6.1.x series, 6.4.2.7 and earlier in the 6.4.x series, and 7.0.0.2 and earlier in the 7.0.x series.
An affected deployment requires certificate-based authentication between a VeloCloud Edge and VCO, access to the public portion of the Edge authentication certificate, and network access to the VCO web interface. Tenant or operator credentials are not required. Organisations that limit the VCO web interface to trusted administrative networks can reduce exposure, although this should be treated as a temporary defensive measure rather than a complete solution. Arista’s EOS-based networking products and several other listed Arista platforms are not affected by this vulnerability.
Administrators should inspect VCO web-access, backend application and system logs for unusual requests, encoded URL components, references to internal services or unusually high request rates. Other warning signs include unexpected outbound traffic, unauthorized configuration changes, unexplained maintenance actions, command execution, file creation, database exports or access to credentials and certificates. Arista specifically identified suspicious files, the x-vc-opt HTTP header and connections from 142.93.149.77 and 104.248.126.159 as indicators requiring investigation.
Arista recommends upgrading to a remediated VCO release as soon as possible. Fixes are available in VCO 5.2.3.16 and later within the 5.2.3 train, and VCO 6.4.2.8 and later within the 6.4.2 train; fixes for other release trains will be added. Until then, organisations should restrict web access, monitor inbound and outbound activity, review administrator actions and watch for backdoors or webshells. If compromise is suspected, operators should preserve relevant logs and file timestamps before remediation, contact Arista TAC, rotate credentials, validate managed Edge devices and consider rebuilding the orchestrator from trusted sources.
