CVE-2026-93952 in VeloCloud Orchestrator On-Prem
Summary
by MITRE • 09/22/2026
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The VeloCloud Orchestrator (VCO) on-premises deployment contains a critical security vulnerability that permits unauthorized remote access to privileged internal functionality. This flaw fundamentally undermines the trust boundary between unauthenticated or low-privilege actors and the core management infrastructure of the software-defined wide area network solution. The presence of this issue indicates a failure in proper access control mechanisms, allowing an attacker who can reach the VCO service over the network to execute administrative commands or retrieve sensitive configuration data without valid credentials. This type of vulnerability is particularly severe because it targets the central nervous system of the SD-WAN architecture, where all policy decisions and connectivity states are managed.
From a technical perspective, this flaw likely stems from insufficient validation of incoming requests against authentication and authorization checks for specific internal API endpoints or management interfaces. In many enterprise orchestration platforms, certain administrative functions may be exposed on ports that are intended for local access only, or they may lack robust input sanitization that prevents privilege escalation through crafted HTTP requests. The ability to access these privileged functionalities means an attacker can manipulate routing policies, modify security rules, extract encryption keys, or view network topology details. This represents a classic instance of broken access control, where the system fails to enforce separation between user roles and administrative capabilities.
The operational impact of exploiting this vulnerability is profound and multifaceted. Compromise of the VCO host directly affects the confidentiality, integrity, and availability of both the orchestrator itself and all data managed by it. Confidentiality is breached as sensitive network configurations, customer premises equipment details, and potentially shared secrets are exposed to the attacker. Integrity is compromised because an adversary can alter routing tables, inject malicious policies that redirect traffic through hostile nodes, or disable security features such as firewalls or intrusion prevention systems configured within the SD-WAN fabric. Availability suffers if the attacker disrupts critical services on the orchestrator host, leading to a loss of connectivity for all managed sites and endpoints dependent on centralized orchestration.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-284 Improper Access Control and potentially CWE-798 Use of Hard-coded Credentials if default or internal service accounts are exploited. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Initial Access via valid credentials obtained from other systems or direct network exploitation, followed by Privilege Escalation to gain administrative control over the orchestration platform. The attack path allows for lateral movement within the managed network once the orchestrator is compromised, as the attacker gains visibility and control over all connected branch offices and data centers.
Mitigation strategies must prioritize immediate remediation through vendor-provided patches, as indicated by the confirmation that hosted and dedicated versions of VCO have already been updated to address this flaw. Organizations running on-premises deployments should apply these updates immediately after verifying compatibility with their specific environment. In addition to patching, network segmentation is critical; administrators must ensure that management interfaces for the orchestrator are not exposed directly to untrusted networks such as the public internet or general corporate LANs without strict firewall rules and multi-factor authentication. Regular vulnerability scanning of administrative ports and continuous monitoring of access logs for anomalous privilege escalation attempts will further reduce the risk surface associated with this type of internal functionality exposure.