VeloCloud Orchestrator (Product): news timeline & CVEs

Arista patches actively exploited VeloCloud Orchestrator zero-day

Arista patches critical zero-day (CVE-2026-93952) in VeloCloud Orchestrator being actively exploited, allowing unauthenticated access to privileged host functions.

Arista Networks has patched CVE-2026-93952, a critical zero-day in VeloCloud Orchestrator (VCO) On-Prem deployments. The actively exploited flaw allows remote attackers to access privileged host functionality without user interaction or privileged credentials. CISA has added the CVE to its KEV catalog, mandating federal agency remediation by September 25, 2026.

BleepingComputerupdated Sep 24, 13:35 UTC · 2d agofirst Sep 23, 12:29 UTC · 3d agoExploit / PoC in the wild 5 sources CVE-2026-939522· 1 read

Arista Urges Immediate Patching of Exploited VCO Zero-Day

Arista patched actively exploited VeloCloud Orchestrator zero-day CVE-2026-93952, now listed in CISA's KEV catalog.

Arista released urgent patches for CVE-2026-93952, a CVSS 10 improper-input-validation zero-day in on-premises VeloCloud Orchestrator that can let remote attackers reach privileged internal functions. The company says the externally discovered flaw is actively exploited, requires network access to the VCO web interface and the public edge authentication certificate, and does not need tenant or operator credentials. Fixes are available in versions 5.2.3.16 and 6.4.2.8. CISA added the bug to the Known Exploited Vulnerabilities catalog and gave federal agencies three days to patch; Arista says there are no definitive indicators of compromise.

SecurityWeekupdated Sep 24, 13:35 UTC · 2d agofirst Sep 23, 08:33 UTC · 4d agoExploit / PoC in the wild 5 sources CVE-2026-93952

Arista Networks security advisory (AV26-947)

Canada's Cyber Centre warns CVE-2026-93952 in Arista VeloCloud Orchestrator is being exploited in the wild.

The Canadian Centre for Cyber Security issued AV26-947 on 22 September 2026 for Arista VeloCloud Orchestrator. Affected on-prem ranges are 5.2.0 through 5.2.3.15, 6.1.0 through 6.1.3.7, 6.4.0 through 6.4.2.7, and 7.0.0 through 7.0.0.2. Open-source reporting indicates CVE-2026-93952 is being exploited in the wild. Administrators are urged to review Arista Security Advisory 0183 and apply updates.

Canadian Centre for Cyber Securityupdated Sep 24, 13:35 UTC · 2d agofirst Sep 22, 13:14 UTC · 4d agoExploit / PoC in the wild 5 sources CVE-2026-93952

New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

Attackers are exploiting a CVSS 10.0 flaw in on-premises Arista VeloCloud Orchestrator deployments that use certificate authentication.

Arista said attackers are exploiting CVE-2026-93952, a CVSS 10.0 flaw in on-premises VeloCloud Orchestrator when Edges authenticate with certificates. An unauthenticated remote attacker who can reach the VCO web interface and knows the public part of an Edge certificate can invoke internal functions and compromise the orchestrator and managed Edge devices. Fixes are available for the 5.2 train from 5.2.3.16 and the 6.4 train from 6.4.2.8; 6.1 and 7.0 have no fix yet. Hosted and Dedicated VCO are already patched, and Arista published indicators including vc-sysmond and IPs 142.93.149.77 and 104.248.126.159.

The Hacker Newsupdated Sep 24, 13:35 UTC · 2d agofirst Sep 22, 12:29 UTC · 4d agoExploit / PoC in the wild 5 sources CVE-2026-93952 CVE-2026-16812

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA added four actively exploited Check Point, Arista VeloCloud, and F5 BIG-IP flaws to the KEV catalog.

On 2026-09-22, CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. They are CVE-2026-85102 (Check Point improper certificate validation), CVE-2026-93616 (Check Point path traversal), CVE-2026-93952 (Arista VeloCloud Orchestrator improper input validation), and CVE-2026-94127 (F5 BIG-IP APM heap-based buffer overflow). Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of high-risk KEV entries on exposed assets. CISA encourages all organizations to remediate these cataloged flaws quickly.

CISA AdvisoriesSep 22, 12:00 UTC · 4d agoExploit / PoC in the wildCVE-2026-85102 CVE-2026-93616 CVE-2026-93952+1 CVEs

VeloCloud Orchestrator

Timeline5 articles

Related CVEsby mentions

Appears with

Arista patches actively exploited VeloCloud Orchestrator zero-day

Arista Urges Immediate Patching of Exploited VCO Zero-Day

Arista Networks security advisory (AV26-947)

New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

CISA Adds Four Known Exploited Vulnerabilities to Catalog