Mapping VeloCloud Orchestrator Exposure: What ZoomEye Data Says About CVE-2026-93952

A CVSS 10.0 vulnerability, CVE-2026-93952, has been discovered in Arista Networks' on-premises VeloCloud Orchestrator (VCO). This flaw is actively being exploited in the wild, prompting security professionals to examine how widespread the issue might be. By analyzing ZoomEye's internet-wide scanning data, it's clear that a significant number of VeloCloud systems are reachable from the public internet.

ZoomEye's analysis reveals six thousand and fifty (6,050) internet-reachable systems containing VeloCloud content in their HTTP bodies. This number is a key indicator of exposure, not a direct measure of vulnerability. The data is gathered by running ZoomEye queries against the VeloCloud fingerprint, which can identify exposed systems with the VeloCloud string in their HTTP bodies. The findings suggest that many VCO systems are exposed, even if they are not yet fully vulnerable due to the lack of specific patch levels.

The data highlights the importance of implementing strict access controls for management planes, such as placing VCO behind secure internal networks. It also illustrates the need for active monitoring, such as reviewing nginx access logs for unusual headers and searching for specific backdoor scripts and persistence files. To remediate this vulnerability, users should upgrade to a fixed build (5.2.3.16 or 6.4.2.8), contact Arista support for systems without published fixes, and restrict access to the VCO web interface.