Thehackernews Critical CVE-2026-93952 Vulnerability in VeloCloud Orchestrator Actively Exploited
Article Content
- •CVE-2026-93952 is a critical vulnerability in VeloCloud Orchestrator with CVSS scores of 10.0 and 9.5.
- •Active exploitation confirmed; attackers can access VCO without tenant credentials if certificate-based authentication is configured.
- •Patches are available for some software versions, but others are still pending; immediate action is required.
A critical vulnerability, CVE-2026-93952, has been identified in Arista Networks' VeloCloud Orchestrator (VCO), allowing unauthenticated remote access to privileged internal functionalities. This flaw, rated CVSS 3.1 10.0 and CVSS 4.0 9.5, affects on-premises deployments configured with certificate-based authentication. Attackers can exploit this vulnerability without needing VCO tenant credentials, compromising the confidentiality, integrity, and availability of the orchestrator and the data it manages. Arista confirmed the vulnerability is actively exploited and has released patches for certain software trains, while others remain pending. Organizations are urged to restrict access to the VCO web interface and monitor for suspicious activity until patches can be applied. CISA added this CVE to its Known Exploited Vulnerabilities catalog on September 22, 2026, with a federal remediation deadline of September 25, 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (12)
Following this threat?
Track Arista and CVE-2026-16812 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access… 
Critical SQL Injection Zero-Day in Arista VeloCloud Orchestrator Actively Exploited Arista Networks has patched a critical SQL injection vulnerability, CVE-2026-114625, in its VeloCloud Orchestrator (VCO) that allows authenticated users to escalate privileges to superuser status. The flaw, rated 9.9 on the CVSS scale, has been actively exploited in the wild, affecting on-premises deployments of VCO.…