CVE-2026-93952
published 2026-09-22CVE-2026-93952: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact…
PriorityP191critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-09-25
Exploited in the wild
EPSS
1.06%
64.3th percentile
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arista | velocloud_orchestrator | >= 5.2.0 < 5.2.3.16 | 5.2.3.16 |
| arista | velocloud_orchestrator | 6.1.0 – 6.1.3.7 | — |
| arista | velocloud_orchestrator | >= 6.4.0 < 6.4.2.8 | 6.4.2.8 |
| arista | velocloud_orchestrator | 7.0.0 – 7.0.0.2 | — |
| arista_networks | velocloud_orchestrator_on-prem | 5.2.0 – 5.2.3.15 | — |
| arista_networks | velocloud_orchestrator_on-prem | 6.1.0 – 6.1.3.7 | — |
| arista_networks | velocloud_orchestrator_on-prem | 6.4.0 – 6.4.2.7 | — |
| arista_networks | velocloud_orchestrator_on-prem | 7.0.0 – 7.0.0.2 | — |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.5CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck10.0CRITICAL
cisa10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
cisa·2026-09-22·CVSS 10.0
CVE-2026-93952 [CRITICAL] CWE-20 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
Vulnerability: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
Affected: Arista VeloCloud Orchestrator
Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of
VulDB
Arista VeloCloud Orchestrator On-Prem up to 5.2.3.15/6.1.3.7/6.4.2.7/7.0.0.2 input validation (EUVD-2026-84296)
vuldb·2026-09-23·CVSS 10.0
CVE-2026-93952 [CRITICAL] Arista VeloCloud Orchestrator On-Prem up to 5.2.3.15/6.1.3.7/6.4.2.7/7.0.0.2 input validation (EUVD-2026-84296)
A vulnerability identified as very critical has been detected in Arista VeloCloud Orchestrator On-Prem up to 5.2.3.15/6.1.3.7/6.4.2.7/7.0.0.2. This affects an unknown function. This manipulation causes improper input validation.
This vulnerability is handled as CVE-2026-93952. The attack can be initiated remotely. Additionally, an exploit exists.
GHSA
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host.
ghsa_unreviewed·2026-09-22
CVE-2026-93952 [CRITICAL] CWE-20 VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
VulnCheck
Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
vulncheck·2026·CVSS 10.0
CVE-2026-93952 [CRITICAL] CWE-20 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Affected: Arista VeloCloud Orchestrator
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product i
No detection rules found.
No public exploits indexed.
Hackernews
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
blogs_hackernews·2026-10-02·CVSS 9.8
CVE-2026-104286 [CRITICAL] Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of active exploitation.
The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.
"An improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] and improper neutralization of NULL byte or NULL chara
Hackernews
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
blogs_hackernews·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface.
Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing exotic. Mostly things nobody expected to matter anymore.
Here’s the full recap of what mattered this week.
## ⚡ Threat of the Week
Citrix
Hackernews
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
blogs_hackernews·2026-09-22·CVSS 10.0
CVE-2026-93952 [CRITICAL] New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22.
The flaw, tracked as CVE-2026-93952 , may allow a remote attacker with no login access to privilege internal functions and affect the VCO host. Only orchestrators set up to authenticate their Edges with certificates are exposed.
As of September 22, fixed releases are out for the 5.2 and 6.4 release trains, but not yet for the 6.1 and 7.0 trains. Arista has already p
2026-09-22
Published
2026-09-22
Added to CISA KEV
Exploited in the wild