New CVSS 10.0 Velo Cloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Summary: Arista said on September 22 that attackers are exploiting CVE-2026-93952, a CVSS 10.0 flaw in on-premises VeloCloud Orchestrator that may let a remote attacker with no login access reach internal functions and affect the VCO host. Only orchestrators configured for certificate-based authentication of VeloCloud Edges are exposed, and fixes were out for the 5.2 and 6.4 trains but not yet for 6.1 and 7.0, while Hosted and Dedicated VCO were already patched.
What you should know: A compromised orchestrator can expose the Edge devices it manages, and Arista says no single indicator proves exploitation, so the only reliable signal is the web access log patterns it lists. The affected releases include those that fixed a different VCO flaw Arista reported as exploited in July, so some organizations may be running builds they believed were already current.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-93952
- Related
- CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista Velo Cloud Cyber Risks ·CVE-2026-93952: Arista Velo Cloud Orchestrator Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Sep 22, 2026