Arista VeloCloud Orchestrator Unauthenticated RCE
“CVE-2026-93952 is a CVSS 10.0 improper input validation flaw in Arista VeloCloud Orchestrator that allows unauthenticated remote code execution. Added to CISA KEV on September 22, 2026.”
- Vendor
- Arista
- Product
- VeloCloud Orchestrator
- CVSS
- 10.0
- EPSS (exploit probability)
- 1.1%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
CVE-2026-93952 is an improper input validation vulnerability in the Arista VeloCloud Orchestrator (VCO) web interface. An unauthenticated attacker with network access to the interface can invoke privileged internal functions and affect the VCO host OS, with full impact on confidentiality, integrity, and availability.
Arista confirmed active exploitation in its September 22 advisory. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 22, 2026, with a federal agency remediation deadline of September 25.
Scope: Only on-premises VCO instances using certificate-based authentication for Edge devices are affected. Hosted and Dedicated VCO were patched before public disclosure.
Affected versions:
| Branch | Vulnerable through | Fixed in |
|---|---|---|
| 5.2 | 5.2.3.15 | 5.2.3.16 |
| 6.1 | 6.1.3.7 | Pending |
| 6.4 | 6.4.2.7 | 6.4.2.8 |
| 7.0 | 7.0.0.2 | Pending |
For 6.1 and 7.0 deployments without a patch, restrict network access to the VCO management interface as an interim control and monitor the Arista advisory for release dates.
