Arista Patches Actively Exploited Critical VCO Zero-Day
Summary
Arista says CVE-2026-93952, a critical VCO input-validation flaw exploited as a zero-day, affects on-premises deployments. Fixed versions are available; administrators should patch and review logs for suspicious activity.
Key points
- CVE-2026-93952 has a CVSS score of 10 and could expose privileged internal functionality, affecting the confidentiality, integrity, and availability of VCO and its data.
- The flaw affects VeloCloud Orchestrator On-Prem; Arista says it is actively exploited.
- Exposure requires network access to the VCO web interface and access to the public portion of a VeloCloud Edge authentication certificate; tenant or operator credentials are not required.
- Fixed releases are VCO 5.2.3.16 and 6.4.2.8; Arista says patches for other trains will follow.
- Arista recommends updating and reviewing VCO web access, backend application, and system logs; it says there are no definitive indicators of compromise.
- CISA added the vulnerability to its Known Exploited Vulnerabilities list; federal agencies were given three days to patch.
Article Details
- Vulnerability Types
- Improper input validation
- Severity
- Critical (CVSS 10)
- Affected Versions
- VeloCloud Orchestrator On-Prem 5.2.x
- VeloCloud Orchestrator On-Prem 6.1.x
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Limit access to the VCO web interface to reduce exposure.
CVE
Vendors
Products
Arista VeloCloud OrchestratorNetworking solutions provider Arista has released urgent patches for a critical-severity vulnerability in on-premises VeloCloud Orchestrator (VCO) deployments that has been exploited as a zero-day.VeloCloud Edge“VCO is exposed if certificate-based authentication from the VeloCloud Edge to VCO is configured.VeloCloud SD-WANVCO is a centralized management tool for configuring, monitoring, and orchestrating edge devices, policies, and traffic in Arista VeloCloud SD-WAN.