Arista patches actively exploited VeloCloud Orchestrator zero-day
Arista patches critical zero-day (CVE-2026-93952) in VeloCloud Orchestrator being actively exploited, allowing unauthenticated access to privileged host functions.
Arista Networks has patched CVE-2026-93952, a critical zero-day in VeloCloud Orchestrator (VCO) On-Prem deployments. The actively exploited flaw allows remote attackers to access privileged host functionality without user interaction or privileged credentials. CISA has added the CVE to its KEV catalog, mandating federal agency remediation by September 25, 2026.
- Arista patched actively exploited zero-day in VeloCloud Orchestrator (CVE-2026-93952).
- Max-severity flaw in certificate-based auth allows low-complexity remote access.
- CISA added CVE-2026-93952 to KEV catalog; agencies must remediate by Sept 25.
- CVEs
- CVE-2026-93952
- Organizations
- Arista NetworksVeloCloudCISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93952 | Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem) | 9.5 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.248.126.159 | lso advised security teams to block the 142[.]93.149.77 and 104[.]248.126.159 IP addresses and review nginx logs for the x-vc-opt HTTP |
| ipv4 | 142.93.149.77 | uest rates. Arista also advised security teams to block the 142[.]93.149.77 and 104[.]248.126.159 IP addresses and review nginx logs |
From the original article
2 min read at bleepingcomputer.comArista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.