Arista Networks security advisory (AV26-947)
Canada's Cyber Centre warns CVE-2026-93952 in Arista VeloCloud Orchestrator is being exploited in the wild.
The Canadian Centre for Cyber Security issued AV26-947 on 22 September 2026 for Arista VeloCloud Orchestrator. Affected on-prem ranges are 5.2.0 through 5.2.3.15, 6.1.0 through 6.1.3.7, 6.4.0 through 6.4.2.7, and 7.0.0 through 7.0.0.2. Open-source reporting indicates CVE-2026-93952 is being exploited in the wild. Administrators are urged to review Arista Security Advisory 0183 and apply updates.
- CVE-2026-93952 affects on-prem VeloCloud Orchestrator 5.2, 6.1, 6.4, and 7.0.
- Open-source reporting says the vulnerability is exploited in the wild.
- The Cyber Centre points administrators to Arista advisory 0183.
- CVEs
- CVE-2026-93952
- Vendors
- Arista Networks
- Products
- VeloCloud Orchestrator
- Organizations
- Canadian Centre for Cyber SecurityArista Networks
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93952 | Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem) | 9.5 | 1% | KEV | KEV |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-947 Date: September 22, 2026 As of September 22, 2026, Arista Networks is affected by a vulnerability in the following product: VeloCloud Orchestrator (VCO) On-Prem Versions 5. 2. 0 to 5.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.