Arista (Organization): news timeline & CVEs

On-prem VeloCloud Orchestrator under attack, only some versions patched

Arista warns the actively exploited CVSS 10.0 VeloCloud Orchestrator flaw CVE-2026-93952 has patches for only some affected release trains.

Arista disclosed CVE-2026-93952, an improper input validation flaw rated CVSS 10.0 in on-premises VeloCloud Orchestrator (VCO) that is known to be actively exploited and gives attackers access to privileged internal functionality. Exploitation requires certificate-based Edge-to-VCO authentication to be configured, plus the Edge certificate public key and network access to the VCO web interface; no tenant or operator credentials are needed, and Qualys assesses it as likely a CSRF-style bypass. Patches exist only for VCO 5.2.3.16+ and 6.4.2.8+; the 6.1.x and 7.0.x trains remain unpatched. Arista shared IoCs including a suspicious vc-sysmond file, the x-vc-opt HTTP header, and two source IPs tied to exploitation.

CSO OnlineSep 24, 13:35 UTC · 2d agoExploit / PoC in the wild 5 sources CVE-2026-93952

U.S. CISA adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog

CISA added four actively exploited Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its KEV catalog, with federal fixes due September 25.

CISA added CVE-2026-85102 (Check Point VPN certificate validation bypass), CVE-2026-93616 (Check Point Security Management Server path traversal), CVE-2026-93952 (Arista VeloCloud Orchestrator input validation), and CVE-2026-94127 (F5 BIG-IP APM heap buffer overflow) to the KEV catalog. Check Point stated CVE-2026-93616 is exploited in the wild with a handful of customers already attacked, and F5 confirmed exploitation of CVE-2026-94127 against APM OAuth Authorization Server configurations. Federal agencies must remediate by September 25, 2026 under BOD 22-01. Check Point has shipped LivePatch/Jumbo Hotfixes and an R82.20 Security Hotfix, plus IOCs for detection.

Security Affairsupdated Sep 25, 10:30 UTC · 2d agofirst Sep 23, 20:37 UTC · 3d agoExploit / PoC in the wild 15 sources

InfraTrust report warns network management systems under attack

Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.

An Eclypsium InfraTrust report highlights a trend of attackers targeting network management systems like Cisco FMC and ISE. Key vulnerabilities include CVE-2026-20079, an actively exploited authentication bypass, and CVE-2026-76460, a critical flaw added to the KEV catalog. Attackers are chaining flaws, using built-in tools, and deploying malware like a Cyclops Blink variant and Qilin ransomware. The trend extends to management software from other vendors, posing a significant risk to enterprise infrastructure.

BleepingComputerSep 23, 14:35 UTC · 3d agoVulnerability in the wildCVE-2026-20079 CVE-2026-20316 CVE-2026-76460+5 CVEs

Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances

CISA adds four actively exploited zero-days to KEV, forcing immediate patching of critical flaws in Check Point, Arista, and F5 systems.

CISA has added four actively exploited zero-day vulnerabilities to its KEV catalog, forcing US federal agencies to patch by September 25. The list includes critical flaws in Check Point Security Management (CVE-2026-93616) and Security Gateway (CVE-2026-85102), alongside zero-days in Arista VeloCloud Orchestrator (CVE-2026-93952) and F5 BIG-IP APM (CVE-2026-94127). Check Point confirmed exploitation against Management Servers and Spark firewalls globally.

Help Net Securityupdated Sep 25, 10:30 UTC · 2d agofirst Sep 23, 10:22 UTC · 4d agoVulnerability in the wild 15 sources CVE-2026-93616 CVE-2026-85102 CVE-2026-93952

Arista

Timeline4 articles

Related CVEsby mentions

Appears with

On-prem VeloCloud Orchestrator under attack, only some versions patched

U.S. CISA adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog

InfraTrust report warns network management systems under attack

Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances