Security Issue in VeloCloud Orchestrator Affecting Arista
CVE-2026-93952

9.5CRITICAL

Key Information:

Vendor: Arista Networks
Status: Velocloud Orchestrator (vco) On-prem
Vendor: CVE Published:; 22 September 2026

🔔 Create Arista Networks Vulnerability Alert

Badges

📈 Trended📈 Score: 3,120👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2026-93952?

CVE-2026-93952 is a serious security vulnerability affecting the VeloCloud Orchestrator (VCO), a network management tool developed by Arista Networks. The purpose of VCO is to facilitate the orchestration of cloud-delivered networking services, optimizing network performance and ensuring efficient management of resources. However, this vulnerability presents a significant risk as it allows remote attackers to gain unauthorized access to privileged internal functionalities within the VCO. Successful exploitation could lead to severe consequences, jeopardizing not only the confidentiality and integrity of the orchestrator but also the availability of data managed by the system itself. The vulnerability has been identified in both hosted and dedicated on-premises versions of VCO, but patches have already been provided to resolve the issue.

Potential impact of CVE-2026-93952

Unauthorized Access: The vulnerability may allow attackers to access sensitive areas of the VCO, leading to unauthorized control over network operations and resources, which can be exploited for malicious purposes.
Data Compromise: Due to the potential breach of confidentiality and integrity, sensitive data managed by the orchestrator could be exposed, altered, or deleted, posing risks to organizational data privacy and security.
Service Disruption: Exploiting this vulnerability could lead to disruptions in the availability of the VCO, negatively impacting network management operations and overall service delivery, potentially resulting in downtime for critical business functions.

CISA has reported CVE-2026-93952

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-93952 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

VeloCloud Orchestrator (VCO) On-Prem VeloCloud Orchestrator On-Prem 5.2.0 <= 5.2.3.15

VeloCloud Orchestrator (VCO) On-Prem VeloCloud Orchestrator On-Prem 6.1.0 <= 6.1.3.7

VeloCloud Orchestrator (VCO) On-Prem VeloCloud Orchestrator On-Prem 6.4.0 <= 6.4.2.7

News Articles

BleepingComputer

CVE-2026-93952

Arista patches actively exploited VeloCloud Orchestrator zero-day

Arista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments.

1 month ago