Arista says attackers are already exploiting a critical flaw in its on-premises VeloCloud Orchestrator, the management system for VeloCloud SD-WAN deployments. The zero-day, CVE-2026-93952, is a CVSS 10 improper input validation bug that can let a remote attacker access privileged internal functionality if they can reach the VCO web interface and have the public part of an Edge authentication certificate; no tenant or operator credentials are required. Fixed versions include VCO 5.2.3.16 and 6.4.2.8, and CISA has added the flaw to KEV.
Why it matters: Organizations using on-premises VeloCloud Orchestrator could face full compromise of the management plane and the data it controls if they do not act quickly. Admins should patch immediately, restrict access to the VCO web interface, and review logs because Arista says there are no definitive indicators of compromise.
Sergiu Gatlan
2026.09.23
99% relevant
This article directly updates the same event by reporting Arista's patch availability, affected and fixed VCO versions, exploitation details, mitigation guidance, indicators of compromise, and CISA's KEV addition with a federal remediation deadline.
Ionut Arghire
2026.09.23
100% relevant
This article establishes a new tracked story by disclosing an actively exploited Arista VeloCloud Orchestrator zero-day, naming the CVE, affected product scope, fixed versions, and CISA KEV action.
← Back to all stories