Warning: VeloCloud Orchestrator Improper Input Validation Vulnerability, Patch Immediately!

CVE/CVSS: CVE-2026-93952: 9.5 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)

CVE-2026-93952 is a critical vulnerability affecting on-premises VeloCloud Orchestrator deployments. Successful exploitation can allow an attacker to compromise the VCO server and the data managed by the orchestrator. Because VCO centrally manages VeloCloud Edge devices, a compromise of the orchestrator could also allow an attacker to gain access to managed network infrastructure, potentially resulting in a significant impact on the confidentiality, integrity, and availability (CIA) triad.

Arista confirms this vulnerability is actively exploited. The vendor advisory contains additional threat hunting and hardening guidance.

CVE-2026-93952 is an improper input validation vulnerability in VeloCloud Orchestrator On-Prem. Successful exploitation may allow a remote attacker to access privileged internal functionality and compromise the VCO host, potentially affecting the confidentiality, integrity and availability of the orchestrator and the data it manages.

VCO deployments are not vulnerable by default. A VCO deployment is only vulnerable when certificate-based authentication between the VeloCloud Edge and VeloCloud Orchestrator (VCO) is configured. Exploitation also requires access to the public portion of the VeloCloud Edge authentication certificate. VCO tenant or operator credentials are not required for exploitation. Restricting access to the VCO web interface to trusted administrative networks can reduce your attack surface.

The vulnerability has been fixed in VCO 5.2.3.16 and later in the 5.2.3 train, and VCO 6.4.2.8 and later in the 6.4.2 train. Arista states that fixes for other supported release trains will be added progressively. Cloud-hosted versions of the platform have already received automated security patches. Standard Arista switches running EOS remain unaffected by this flaw.

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing. Organisations running a release train for which a fix is not yet listed should Arista Technical Assistance Center to determine the appropriate upgrade path.

If immediate patching is not feasible, organisations should restrict access to the VCO web interface to trusted administrative networks and monitor or restrict unnecessary outbound network connectivity from the VCO host. These measures should only be considered temporary risk-reduction measures and not a replacement for patching.

The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion. Organisations should conduct a threat hunt based on the guidance outlined in the vendor advisory and monitor this advisory for future updates. If a compromise is suspected, operators should follow the vendor's recommendations and, where operationally feasible, preserve several forensic artifacts, before initiating remediation.

In case of an intrusion, you can report an incident via .

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.