CVE-2026-93952 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-22

Added to CISA KEV: 2026-09-22 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — PATCH IMMEDIATELY: Upgrade to VCO 5.2.3.16+ (5.2.x train) or VCO 6.4.2.8+ (6.4.x train). For other release trains, contact Arista TAC immediately. This is a CVSS 10.0 vulnerability with confirmed active exploitation.
INCIDENT RESPONSE FIRST: Before patching, assess whether your VCO has already been compromised. Review VCO access logs for anomalous unauthenticated requests to privileged endpoints. Scan for webshells in the VCO web application directories. Check for new or modified administrator accounts. Review recent configuration changes for unauthorised modifications.
NETWORK ISOLATION (immediate interim if patching is delayed): Restrict VCO web interface access to a defined allowlist of trusted administrative IP ranges using firewall rules or network ACLs. Block all internet-originating traffic to the VCO web interface port (TCP 443/80). This is the single highest-impact interim mitigation.
MONITOR for post-exploitation indicators as advised by Arista: backdoor daemons, webshells, unexpected outbound connections from the VCO host, and anomalous administrator activity.
EDGE CERTIFICATE REVIEW: Assess exposure of VeloCloud Edge public certificates. While public certificates are inherently non-secret, understanding which certificates are in circulation informs attacker capability.
MSP/MULTI-TENANT OPERATORS: Treat this as a potential full tenant data breach scenario. Notify affected customers per applicable breach disclosure obligations and initiate forensic review of all tenant configurations and data.
MONITOR OUTBOUND: Block and alert on unexpected outbound connections from the VCO host, particularly to non-SD-WAN destinations, as this may indicate C2 beaconing post-compromise.
PATCH PRIORITY: CRITICAL — treat as P0/emergency patch. Do not wait for scheduled maintenance windows.

🔍 Web Intelligence (Kagi · 2026-09-22)

Summary

CVE-2026-93952 is a critical security vulnerability (CVSS 10.0) affecting on-premises installations of the VeloCloud Orchestrator (VCO) component. The flaw stems from a failure in access control mechanisms, which allows a remote, unauthenticated attacker to access privileged internal functionality within the Orchestrator. This vulnerability is highly significant because it can lead to a complete compromise of the orchestrator host and the sensitive data managed by the system, necessitating immediate attention from organizations utilizing on-premises VCO deployments.

Exploitation

Active Exploitation: The vulnerability is currently being exploited in the wild, with attackers specifically targeting certificate-authenticated VeloCloud Orchestrators ^[1].
Threat Actors: Reports indicate active exploitation campaigns are underway, though specific named threat actors or ransomware groups have not been broadly publicized at this time ^[1].
Proof-of-Concept: While exploit activity is confirmed in the wild, public proof-of-concept code is generally managed within security advisories or limited researcher disclosures to minimize further risk.
Attack Prerequisites: The attack is remote and does not require user interaction or valid login credentials; however, it requires the attacker to be able to reach the VCO service over the network ^[4]^[5].

Affected Products & Patches

Affected Products: On-premises versions of the VeloCloud Orchestrator (VCO) are impacted. While hosted and dedicated versions were also affected, those environments have reportedly been remediated ^[2].
Patch Availability: Organizations should review the official Arista Networks security advisory (Security Advisory 0183) for the specific release train patches or hotfixes required for their deployment ^[3].
Mitigation: Where patches cannot be applied immediately, access to the VCO service should be restricted at the network level to prevent unauthorized remote access until updates are installed.

Impact

System Access: Successful exploitation provides a remote attacker with access to privileged internal functions of the VeloCloud Orchestrator, allowing them to impact the VCO host directly.
Business Risk: The risk to internet-facing deployments is critical, as it can result in the full compromise of the confidentiality, integrity, and availability of the orchestrator itself and all associated network data managed by the system ^[2]^[3].

Sources

New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in ...
Attackers are exploiting CVE-2026-93952 in certificate-authenticated VeloCloud Orchestrators, with some release trains still awaiting fixes.
CVE-2026-93952 - Vulnerability Details - OpenCVE
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by…
Security Advisory 0183 - Arista
September 22, 2026 VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality,…
CVE-2026-93952 - Exploits & Severity - Feedly
A critical vulnerability CVE-2026-93952 in the VeloCloud Orchestrator VCO is being actively exploited, allowing remote attackers to access privileged internal functions without needing login credentia…
CVE-2026-93952 in VeloCloud Orchestrator On-Prem
The presence of this issue indicates a failure in proper access control mechanisms, allowing an attacker who can reach the VCO service over the ...

🔴 CVE-2026-93952