Critical severity10.0CISA KEVNVD Advisory· Published Sep 22, 2026· Updated Sep 23, 2026
CVE-2026-93952
CVE-2026-93952
Description
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*range: >=5.2.0,<5.2.3.16
Patches
Vulnerability mechanics
References
2- www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183nvdMitigationVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
9- CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloudThe Hacker News · Oct 24, 2026
- Attackers Exploit Third Arista VCO Zero-Day in Four MonthsSecurityWeek · Oct 23, 2026
- Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in AttacksThe Hacker News · Oct 22, 2026
- Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File WritesThe Hacker News · Oct 2, 2026
- ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More ThreatsThe Hacker News · Sep 28, 2026
- Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instancesHelp Net Security · Sep 23, 2026
- Arista Urges Immediate Patching of Exploited VCO Zero-DaySecurityWeek · Sep 23, 2026
- New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based SetupsThe Hacker News · Sep 22, 2026
- CISA Adds Four Known Exploited Vulnerabilities to CatalogCISA Alerts