CVE-2026-93952: arista velocloud_orchestrator

CVSS 10.0 (critical) · listed as exploited by CISA since 2026-09-22 · published 2026-09-22

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Affected products (NVD): arista velocloud_orchestrator

Fixed in (NVD): 5.2.3.16, 6.4.2.8

Weakness: CWE-20

Source: NVD CVE-2026-93952

References

• https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.