CVE-2026-93952

Security Advisory 0183

Published: Sep 22, 2026Updated: Sep 23, 2026 Sources: CVE List NVDCWE-20

10.0CRITICAL

Description

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

In plain language

AI Act now

This is a critical break-in flaw in unpatched VeloCloud Orchestrator (VCO) On-Prem systems that attackers are actively using, so act now.

Executive summary

Unauthenticated network access to privileged internal VeloCloud Orchestrator functionality enables full confidentiality, integrity, and availability compromise.

If affected, business impact

Administrative system takeoverSensitive data exposureConfiguration tamperingService disruption

What to do now

Check whether you run VeloCloud Orchestrator (VCO) On-Prem and identify its installed software version.
Upgrade the 5.2.3 release train to VCO 5.2.3.16 or later, or upgrade the 6.4 release train to VCO 6.4.2.8 or later.
Until the upgrade is complete, limit access to the VCO web interface to trusted administrator networks and investigate unexpected access attempts.

Some work to apply

What is it

A flaw in the management system can let an outsider reach powerful internal controls without being invited in. It is like someone finding an unlocked door directly into your business’s control room, where they could view information, change settings, or interrupt operations.

Who is affected

This matters to you if you run VeloCloud Orchestrator (VCO) On-Prem to manage network connections. It affects systems that have not received the vendor’s corrected software release, and an attacker does not need an account or employee assistance.

How urgent is it

Attackers are already exploiting this vulnerability. It is listed in CISA’s catalog of vulnerabilities known to be used in real attacks, with remediation due by September 25, 2026; treat this as an immediate priority.

What to do — in detail

Confirm the deployed VeloCloud Orchestrator version and whether its web interface is reachable from untrusted networks. Upgrade the 5.2.3 branch to 5.2.3.16 or later, or the 6.4 branch to 6.4.2.8 or later; review the vendor’s release notes and maintenance procedure before deployment. Hosted and Dedicated deployments were already patched according to the advisory, but confirm patch status with the service provider. If patching is delayed, restrict the web interface to trusted administrative networks and review VCO access records for unfamiliar source addresses or administrative activity. CISA’s KEV remediation due date is September 25, 2026; monitor for suspicious access attempts and unexpected configuration or data changes.

Technical context

CVSS v3.1 is 10.0 (Critical): AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The reported weakness is CWE-20 (Improper Input Validation), enabling remote unauthenticated access to privileged internal functionality and potential compromise of the orchestrator host and managed data. CISA added CVE-2026-93952 to KEV on 2026-09-22, and vendor reporting states it is actively exploited, including in certificate-based setups. No public exploit code is on record. No EPSS value or trend was provided.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:CScope

Changed

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-20

Affected Products

arista

commercial·US

velocloud orchestratorOn-prem

Networking Infrastructure / router-switch

Arista Networks

commercial·US

VeloCloud Orchestrator (VCO) On-PremEmbedded

Networking Infrastructure / router-switch

Exploitability

CISA Known Exploited Vulnerability

Added to KEV:Sep 22, 2026

Remediation due:Sep 25, 2026

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Official Patch Available

Workaround Available

Is your org exposed to CVE-2026-93952?Request an assessment to establish which checks are appropriate for your systems. Check my exposure