Arista VeloCloud Orchestrator Unauthenticated RCE
“CVE-2026-93952 is a CVSS 10.0 improper input validation flaw in Arista VeloCloud Orchestrator that allows unauthenticated remote code execution. Added to CISA KEV on September 22, 2026.”
- Vendor
- Arista
- Product
- VeloCloud Orchestrator
- CVSS
- 10.0
- EPSS (exploit probability)
- 1.4%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-93952 being exploited?
Yes. CISA added CVE-2026-93952 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.4% (scored October 25, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-93952 timeline
- Added to CISA KEVsame day as NVD
- Added to EU KEV (ENISA)same day as NVD
- Published to NVD
- First 0dayNews coverage+1d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-93952 is an improper input validation vulnerability in the Arista VeloCloud Orchestrator (VCO) web interface. An unauthenticated attacker with network access to the interface can invoke privileged internal functions and affect the VCO host OS, with full impact on confidentiality, integrity, and availability.
Arista confirmed active exploitation in its September 22 advisory. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 22, 2026, with a federal agency remediation deadline of September 25.
Scope: Only on-premises VCO instances using certificate-based authentication for Edge devices are affected. Hosted and Dedicated VCO were patched before public disclosure.
Affected versions:
| Branch | Vulnerable through | Fixed in |
|---|---|---|
| 5.2 | 5.2.3.15 | 5.2.3.16 |
| 6.1 | 6.1.3.7 | Pending |
| 6.4 | 6.4.2.7 | 6.4.2.8 |
| 7.0 | 7.0.0.2 | Pending |
For 6.1 and 7.0 deployments without a patch, restrict network access to the VCO management interface as an interim control and monitor the Arista advisory for release dates.
Other Arista CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-16812 Arista VeloCloud Orchestrator OS Command Injectionwrite-up | [ CRITICAL ] | 10.0 | 1.8% | |
| CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability | [ MEDIUM ] | 5.8 | 1.1% |
