Certificate-Based Auth in VeloCloud Orchestrator Enables Unauthenticated Remote Compromise

The flaw affects VeloCloud Orchestrator versions using Certificate Acquire or Certificate Required modes for Edge authentication. Attackers need only network reachability to the web interface plus the public portion of a valid Edge certificate; no credentials are required. Successful exploitation allows internal function privilege escalation, host compromise, and downstream control of managed Edges. Arista rates it CVSS 10.0 and confirms active exploitation, distinct from the July CVE-2026-16812 that required no configuration.

Evidence comes from Arista's September 22 advisory listing affected releases (5.2.3.15 and earlier, 6.1.3.7 and earlier, 6.4.2.7 and earlier, 7.0.0.2 and earlier) plus concrete IOCs including /usr/local/sbin/.vcnode.js, vc-sysmond with MD5 dc78e206eaeadec59fc5801fe4556bd0, and IPs 142.93.149[.]77 and 104.248.126[.]159. Logs showing unusual URL paths or x-vc-opt headers further indicate compromise. The July flaw was configuration-independent; this one is gated exactly on certificate settings, exposing a narrow but high-value attack surface.

The pattern shows repeated reliance on certificate issuance without sufficient request validation at the orchestrator layer. Certificate modes were intended to raise security over PSK yet created an externally reachable vector when the public cert material and web interface coincide. Procurement records for SD-WAN orchestrators rarely mandate network segmentation or certificate pinning beyond basic issuance, leaving the same exposure in other vendors' control planes.

Patches exist for 5.2 and 6.4 trains; 6.1 and 7.0 remain open. Operators unable to upgrade must restrict web interface access, monitor the listed IOCs, and rotate credentials post-upgrade. Unpatched certificate deployments will continue to draw targeted exploitation.