Detect Arista VeloCloud Orchestrator Improper Input Validation (CVE-2026-93952) in CrowdStrike LogScale
Detects exploitation attempts and post-exploitation activity targeting CVE-2026-93952, an improper input validation vulnerability (CWE-20) in Arista VeloCloud Orchestrator (VCO). Listed in CISA KEV. The flaw permits attacker-supplied input to bypass validation on VCO management/API endpoints, enabling remote code execution or unauthorized command execution against the orchestrator. Detection focuses on anomalous requests to VCO API/admin paths, malformed input payloads reaching orchestrator endpoints, unexpected process spawning from the VCO web/application tier, and outbound connections from the orchestrator host.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=/^(ProcessRollup2|NetworkConnectIP4)$/
| ImageFileName=/(java|nginx|node|httpd|python)/i
| CommandLine=/(sh|bash|curl|wget|nc|ncat)\s/i
| CommandLine=/(\.\.\/|\$\(|;|\||`|%2e%2e)/i
| groupBy([aid, ParentBaseFileName], function=([count(as=spawns), collect([CommandLine, ImageFileName])]))
| spawns >= 1CrowdStrike CQL detection for shell/download utilities spawned by the VeloCloud Orchestrator web/application tier with injection-style command lines, indicating post-exploitation of CVE-2026-93952.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate maintenance or deployment scripts run by the service account
- Monitoring agents invoking shell utilities
- Administrator troubleshooting sessions on the orchestrator host
Other platforms for CVE-2026-93952
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated path traversal POST to VCO API endpoint
Expected signal: Proxy/web logs record a POST to /api/ with a ../ traversal token in the body.
- Test 2Simulated command-injection payload to VCO admin path
Expected signal: Web logs show a PUT to /admin/ containing $( and ; metacharacters.
- Test 3Post-exploitation shell spawn from application tier
Expected signal: EDR records bash/curl/wget spawned by the application service account with a download command line.
References (5)
- https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-93952
- https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html
Response Playbook
Triage
- Confirm the destination host is an Arista VeloCloud Orchestrator instance and record its build/version against Arista Security Advisory 0183 to determine whether it is a patched release.
- Extract the full request URL and body from the alerting event and identify the specific input-validation-bypass pattern (path traversal, command injection metacharacters, script/SQL payload) that fired.
- Determine whether the source IP is an authorized administrator, known automation/scanner, or an unexpected external address; check for prior authentication or session context.
- Correlate the timestamp with orchestrator application/web logs and host process telemetry to see if any child process, file write, or outbound connection followed the request.
Containment
- If exploitation is confirmed or strongly suspected, isolate the VCO management interface — restrict access to a trusted admin allowlist via firewall/ACL and block the source IP.
- Apply the vendor fix per Arista Security Advisory 0183 (upgrade to the patched VeloCloud Orchestrator release) as prioritized under CISA BOD 26-04, or take the orchestrator offline if patching cannot be immediate.
- Rotate orchestrator administrative credentials, API tokens and any secrets reachable from the VCO host, and terminate active suspicious sessions.
Evidence Collection
- Preserve VCO web/application and access logs, the raw offending HTTP request/response, and any generated error or audit entries around the event window.
- Capture a forensic image or volatile-data snapshot (process list, network connections, recently modified files, cron/systemd persistence) of the orchestrator host before remediation.
Escalation Criteria
- !Escalate to incident response immediately if a shell, download utility, or unexpected outbound connection is observed following the malformed request, indicating successful RCE.
- !Escalate to management and consider regulatory/CISA notification if the orchestrator manages production SD-WAN edges and lateral movement, config tampering, or edge-device compromise is evident.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
VCO web/application server access and error logs showing the malformed POST/PUT request - >
New or modified files, cron/systemd units, or web-shell artifacts on the orchestrator host - >
Process execution records showing shell/download utilities spawned by the application service account
Tuning Guidance
Build a reference set of authorized administrator and automation source IPs and known scanner ranges, then exclude them from the alert to cut benign matches. Baseline the legitimate special characters that appear in valid VCO configuration payloads so the injection regex is tuned to genuine bypass attempts rather than escaped JSON. Once the orchestrator fleet is confirmed patched to the Advisory 0183 release, lower severity to informational for tracking while retaining the post-exploitation process correlation at high fidelity.
Hunting Queries
Surfaces source IPs generating high-volume or brute-force-style access to VeloCloud Orchestrator management endpoints, useful for spotting reconnaissance or exploitation attempts around CVE-2026-93952.
CommonSecurityLog | where DestinationHostName has_any ("velocloud","vco","orchestrator") | where RequestURL has_any ("/api/","/portal/","/admin/") | summarize Requests=count(), Methods=make_set(RequestMethod) by SourceIP, bin(TimeGenerated, 1h) | where Requests > 50index=proxy (dest_host="*velocloud*" OR dest_host="*vco*") (url="*/api/*" OR url="*/admin/*") | stats count values(method) as methods by src_ip | where count > 50Atomic Red Team Tests
Sends a POST request containing a path-traversal sequence to a lab VeloCloud Orchestrator API path to validate the improper-input-validation detection logic.
Command
curl -sk -X POST "https://vco.lab.local/api/edge/config" --data 'name=../../../../etc/passwd&val=test' -H 'Content-Type: application/x-www-form-urlencoded'Cleanup
echo 'No cleanup required; no server-side state created in lab.'Expected Telemetry
Proxy/web logs record a POST to /api/ with a ../ traversal token in the body.
Expected Detection
KQL/SPL rules fire on the path-traversal metacharacter in a POST to a VCO endpoint.
Submits a command-injection style payload to a lab orchestrator admin endpoint to exercise the metacharacter detection.
Command
curl -sk -X PUT "https://vco.lab.local/admin/settings" --data 'hostname=$(id);echo test' -H 'Content-Type: application/x-www-form-urlencoded'Cleanup
echo 'No cleanup required.'Expected Telemetry
Web logs show a PUT to /admin/ containing $( and ; metacharacters.
Expected Detection
Input-validation-bypass regex matches the injection metacharacters in the request.
Simulates a web/application service account spawning a shell that runs a download utility, mimicking successful RCE on the orchestrator host.
Command
sudo -u www-data /bin/bash -c 'curl -s http://127.0.0.1/healthz; wget -q http://127.0.0.1/beacon -O /tmp/beacon'Cleanup
rm -f /tmp/beaconExpected Telemetry
EDR records bash/curl/wget spawned by the application service account with a download command line.
Expected Detection
Elastic EQL sequence and CrowdStrike CQL fire on shell/download utility spawned by the web tier.