Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-25. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-93952: Improper Input Validation in VeloCloud Orchestrator, 10.0 Rating 🔥 A recently disclosed improper input validation vulnerability in on-premises VeloCloud Orchestrator (VCO) allows a remote attacker to access privileged internal functionality and impact the VCO host. This vulnerability is known to be actively exploited in the wild! 👉 https://nt.ls/Z9gGT
An exploited VeloCloud vulnerability with a 10.0 CVSS score hits Arista appliances. Patch the critical VeloCloud vulnerability to stop active attacks. #VeloCloud #Arista #CVE202693952 #ZeroDay #Cybersecurity #Infosec https://securityonline.info/velocloud-vulnerability-cve-2026-93952/
🚨 Arista Warns of Actively Exploited VeloCloud Orchestrator Flaw CVE-2026-93952 (CVSS 10.0) Critical Vulnerability Alert! VeloCloud Orchestrator (VCO) on-premises is affected by CVE-2026-93952. 🔍 Identify Targets via ZoomEye: Search Dork: http.body="VeloCloud" Exposure: 6k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=aHR0cC5ib2R5PSJWZWxvQ2xvdWQi #Infosec #CyberSecurity #ZoomEye