Reported by 14 outlets
An exploited VeloCloud vulnerability with a 10.0 CVSS score hits Arista appliances. Patch the critical VeloCloud vulnerability to stop activ
Why this score
- Breadth
- 2.00 / 2.0 · 14 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.22 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Arista patched CVE-2026-93952, a maximum-severity (CVSS 10.0) zero-day in VeloCloud Orchestrator (VCO) On-Prem deployments that was discovered externally and is actively exploited. The flaw is an improper input validation weakness in certificate-based authentication from the VeloCloud Edge to the orchestrator. A remote attacker needs only network access to the VCO web interface and access to the public portion of the Edge authentication certificate; no tenant or operator credentials are required, and Arista describes successful attacks as low complexity. Exploitation grants unauthenticated access to privileged internal VCO host functionality, which matters because VCO centrally manages VeloCloud SD-WAN edges, so orchestrator compromise reaches the management plane of the whole WAN fabric.
Arista's Tuesday advisory says hosted VCO deployments running 5.2.3.16 or later and 6.4.2.8 or later were already patched, with security patches released for on-prem instances on 6.1.3.7 and below and 7.0.0.2 and below. CISA added the CVE to the KEV catalog, putting federal agencies on BOD 22-01-style remediation clocks. On-prem orchestrators are the exposure: hosted customers were patched by Arista, while self-hosted operators had to find and apply the fix themselves.
This is the second exploited VeloCloud Orchestrator vulnerability in 2026, and secondary coverage now stresses the cadence: two CVSS 10.0 exploited flaws in roughly three months. In July, CVE-2026-16812, an OS command injection in the on-prem orchestrator, was exploited as a zero-day and added to KEV. Repeated zero-day targeting of the same SD-WAN management product suggests attackers treat VCO as a high-value entry point into enterprise networks. Watch for incident disclosures naming CVE-2026-93952, exploitation of internet-facing VCO instances, and whether Arista discloses attacker activity observed on the hosted side.
Timeline
-
original reporting
An exploited VeloCloud vulnerability with a 10.0 CVSS score hits Arista appliances. Patch the critical VeloCloud vulnerability to stop activ
securityonline.info · 22d ago · September 22nd, 2026
An exploited VeloCloud vulnerability with a 10.0 CVSS score hits Arista appliances. Patch the critical VeloCloud vulnerability to stop activ
via Mastodon https://securityonline.info/velocloud-vulnerability-cve-2026-93952/?utm_source=mastodon&utm_medium=jetpack_social
-
update from cisa.gov
CISA Adds Two Known Exploited Vulnerabilities to Catalog
cisa.gov · 79d ago · July 27th, 2026
CISA added CVE-2025-68686 (Fortinet FortiOS exposure of sensitive information to an unauthorized actor) and CVE-2026-16812 (Arista VeloCloud Orchestrator on-prem OS command injection) to the KEV catalog on July 27, 2026, citing evidence of active exploitation for both. The alert ties KEV entries to BOD 26-04 remediation timelines for federal civilian agencies.
-
update from thehackernews.com
Attackers Exploit Arista VeloCloud Orchestrator Command Injection
thehackernews.com · 78d ago · July 28th, 2026
The Hacker News reported on July 28, 2026 that attackers were exploiting CVE-2026-16812 in on-prem Arista VeloCloud Orchestrator. It described the flaw as a command injection bug that could extend an attacker's access to managed devices.
-
update from securityweek.com
Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day
securityweek.com · 78d ago · July 28th, 2026
SecurityWeek reported on July 28, 2026 that hackers had been exploiting a critical OS injection vulnerability in Arista VeloCloud Orchestrator as a zero-day. The report covers the same on-prem orchestrator product affected by the September CVE-2026-93952 exploitation.
-
mentioned by radar.offseq.com
CVE-2026-93952 (CRITICAL, CVSS 10) impacts Arista VeloCloud Orchestrator (On-Prem) via improper input validation. Remote, unauthenticated ac
radar.offseq.com · 21d ago · September 22nd, 2026
-
update from malware.news
Arista Networks security advisory (AV26-947)
malware.news · 21d ago · September 22nd, 2026
Serial number: AV26-947 Date: September 22, 2026 As of September 22, 2026, Arista Networks is affected by a vulnerability in the following product: VeloCloud Orchestrator (VCO) On-Prem Versions 5.2.0 to 5.2.3.15 Versions 6.1.0 to 6.1.3.7 Versions 6.4.0 to 6.4.2.7 Versions 7.0.0 to 7.0.0.2 Open-source reporting indicates that CVE-2026-93952 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security Advisory 0183 Arista Networks Advisories & Notices Article Link: Arista Networks security advisory (AV26-947) - Canadian Centre for Cyber Security
-
mentioned by cyberworldops.eu
Arista disclosed active exploitation of CVE-2026-93952, a CVSS 10.0 unauthenticated flaw in on-prem VeloCloud Orchestrator with certificate
cyberworldops.eu · 21d ago · September 22nd, 2026
-
update from thehackernews.com
🤖 CVE-2026-93952 (CVSS 10.0): actively exploited flaw in on-prem VeloCloud Orchestrator lets unauthenticated remote attackers reach internal
thehackernews.com · 21d ago · September 22nd, 2026
🤖 CVE-2026-93952 (CVSS 10.0): actively exploited flaw in on-prem VeloCloud Orchestrator lets unauthenticated remote attackers reach internal
via Mastodon https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html
-
update from www.yazoul.net
🔴 New security advisory: CVE-2026-93952 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R
www.yazoul.net · 21d ago · September 23rd, 2026
🔴 New security advisory: CVE-2026-93952 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R
via Mastodon https://www.yazoul.net/advisory/cve/cve-2026-93952-velocloud-orchestrator-unauth-rce-exploited
-
update from securityweek.com
Arista Urges Immediate Patching of Exploited VCO Zero-Day
securityweek.com · 20d ago · September 23rd, 2026
Networking solutions provider Arista has released urgent patches for a critical-severity vulnerability in on-premises VeloCloud Orchestrator (VCO) deployments that has been exploited as a zero-day. VCO is a centralized management tool for configuring, monitoring, and orchestrating edge devices, policies, and traffic in Arista VeloCloud SD-WAN. Successful exploitation of the security defect could impact the confidentiality, integrity, and availability of the orchestrator and the data it manages. “This issue was discovered externally and is known to be actively exploited,” Arista warns . According to the company, the bug affects only VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom) and was resolved in VCO versions 5.2.3.16 and 6.4.2.8 in the 5.2.x and 6.1.x trains, respectively. Patches for other trains will also be released. “VCO is exposed if certificate-based authentication from the VeloCloud Edge to VCO is configured. Access to the public portion of the VeloCloud Edge authentication certificate is required. A successful attack requires network access to the VCO web interface. VCO tenant or operator credentials are not required for this exposure,” the company notes. Arista says that deployments that limit acc
-
mentioned by meterpreter.org
Arista confirmed active exploitation of a CVSS 10 VeloCloud Orchestrator vulnerability (CVE-2026-93952) affecting certificate-based SD-WAN s
meterpreter.org · 20d ago · September 23rd, 2026
-
mentioned by radar.offseq.com
CVE-2026-93952: CRITICAL zero-day in Arista VeloCloud Orchestrator (on-prem https:// radar.offseq.com/threat/arista -urges-immediate-patchin
radar.offseq.com · 20d ago · September 23rd, 2026
-
update from bleepingcomputer.com
Arista patches actively exploited VeloCloud Orchestrator zero-day
bleepingcomputer.com · 20d ago · September 23rd, 2026
VCO is a cloud-based centralized management platform that helps admins configure, monitor, and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices. Remote threat actors can exploit the vulnerability to access privileged internal VCO host functionality in low-complexity attacks that don't require privileges on the targeted system or user interaction. Cybersecurity and Infrastructure Security Agency has also added CVE-2026-93952 to its Known Exploited Vulnerabilit
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-93952: actively exploited zero-day in Arista VeloCloud Orchestrator (VCO) On-Prem. Improper input validation in cert-based auth l
www.bleepingcomputer.com · 20d ago · September 23rd, 2026
-
mentioned by cybersecurefox.com
CVE-2026-93952: CVSS 10.0 vulnerability in Arista VeloCloud Orchestrator 🔗 https:// cybersecurefox.com/en/cve-2026 -93952-arista-velocloud-o
cybersecurefox.com · 19d ago · September 24th, 2026
-
mentioned by beyondmachines.net
Arista Networks Patches Critical VeloCloud Orchestrator Zero-Day Exploited in the Wild Arista Networks disclosed a critical CVSS 10.0 vulner
beyondmachines.net · 19d ago · September 24th, 2026
-
mentioned by dev.to
Arista VeloCloud Orchestrator CVE-2026-93952: Active Exploitation of Authentication Bypass Zero-Day # security # threatintel # software # co
dev.to · 19d ago · September 24th, 2026
-
mentioned by www.bleepingcomputer.com
# Arista patches actively exploited # VeloCloud # Orchestrator zero-day https://www. bleepingcomputer.com/news/secu rity/arista-patches-acti
www.bleepingcomputer.com · 19d ago · September 24th, 2026
-
mentioned by diesec.com
(diesec.com) Critical Zero-Day Vulnerability in Arista VeloCloud Orchestrator Under Active Exploitation In brief - This article discusses a
diesec.com · 15d ago · September 28th, 2026
-
mentioned by diesec.com
Arista VeloCloud Orchestrator: 2nd CVSS-10.0 CVE in 3 months. CVE-2026-93952 gives unauthenticated privileged access, actively exploited. Pa
diesec.com · 15d ago · September 28th, 2026