by Kastro
Paper/Archive/CVE-2026-93952

CVE-2026-93952

Arista Networks VeloCloud Orchestrator (VCO) On-Prem — Security Advisory 0183

KEV · due 25 SepEPSS 1%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
94
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 72.1.721 × 2014.4Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Affected

ProductAffectedFixed inSource
VeloCloud Orchestrator (VCO) On-Prem5.2.0 – 5.2.3.15–CNA
VeloCloud Orchestrator (VCO) On-Prem6.1.0 – 6.1.3.7–CNA
VeloCloud Orchestrator (VCO) On-Prem6.4.0 – 6.4.2.7–CNA
VeloCloud Orchestrator (VCO) On-Prem7.0.0 – 7.0.0.2–CNA

Scores by source

Arista (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Arista (CNA)9.5CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisoryarista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952kevcisa.gov/known-exploited-vulnerabilities-catalog