Arista Velocloud Orchestrator vulnerabilities
3 known vulnerabilities affecting arista/velocloud_orchestrator.
Total CVEs
3
CISA KEV
2
actively exploited
Public exploits
0
Exploited in wild
2
Severity breakdown
CRITICAL2HIGH1
Vulnerabilities
Page 1 of 1
CVE-2026-93952P1CRITICALCVSS 10.0KEV≥ 5.2.0, < 5.2.3.16≥ 6.1.0, ≤ 6.1.3.7+2 more2026-09-22
CVE-2026-93952 [CRITICAL] CWE-20 CVE-2026-93952: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attack
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Hosted, including Dedicated, ve
nvd
CVE-2026-16812P1CRITICALCVSS 10.0KEV≥ 5.2.0, < 5.2.3.14≥ 6.1.0, < 6.1.3.4+2 more2026-07-27
CVE-2026-16812 [CRITICAL] CWE-78 CVE-2026-16812: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attack
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
This functionality was intende
nvd
CVE-2020-3973P3HIGHCVSS 8.8≥ 3.1.1, < 3.3.2v3.3.2+1 more2020-07-08
CVE-2020-3973 [HIGH] CWE-89 CVE-2020-3973: The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-inject
The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged.
nvd