Arista Urges Immediate Patching of Exploited VCO Zero-Day
Arista patched actively exploited VeloCloud Orchestrator zero-day CVE-2026-93952, now listed in CISA's KEV catalog.
Arista released urgent patches for CVE-2026-93952, a CVSS 10 improper-input-validation zero-day in on-premises VeloCloud Orchestrator that can let remote attackers reach privileged internal functions. The company says the externally discovered flaw is actively exploited, requires network access to the VCO web interface and the public edge authentication certificate, and does not need tenant or operator credentials. Fixes are available in versions 5.2.3.16 and 6.4.2.8. CISA added the bug to the Known Exploited Vulnerabilities catalog and gave federal agencies three days to patch; Arista says there are no definitive indicators of compromise.
- CVE-2026-93952 is a CVSS 10 improper-input-validation flaw in on-prem VCO.
- Arista says the externally found bug is actively exploited and requires no credentials.
- Exposure needs edge certificate authentication and network access to the web interface.
- Fixes are VCO 5.2.3.16 and 6.4.2.8, with more trains planned.
- CISA added it to KEV and gave federal agencies three days to patch.
- CVEs
- CVE-2026-93952
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93952 | Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem) | 9.5 | 1% | KEV | KEV |
From the original article
1 min read at securityweek.com
Remote attackers could trigger the critical-severity flaw to access privileged internal functionality. The post Arista Urges Immediate Patching of Exploited VCO Zero-Day appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.