CVE-2026-93952Active Exploitation(arista / velocloud_orchestrator)

HIGHCVSS 9.5 · CRITICALCISA KEV

Exploitation observed; activity peaked at 29 mentions and remains active

Immediate actions

Patch arista velocloud_orchestrator systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

arista CVEs Back to dashboard

6.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-25. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor / third-party advisories

https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952

Weakness type (CWE)

CWE-20

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

velocloud_orchestrator

Threat summary

Active exploitation appears in 76 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
85 mentions across 15 observed days

What's happening

Active exploitation reported across 76 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 56 signals
Technical details provided in 72 signals
Disclosure: 4 classified signals
Peaked 13d ago at 29 mentions (2026-09-23); latest day: 1
85 total mentions across 15 days

Affected systems

Vendors

arista

Products

velocloud_orchestrator

Deep dive

Activity timeline85 mentions / 15d

Signal classification4 categories

Active Exploitation

7689.4%

Disclosure

44.7%

Patch

44.7%

General

11.2%

Referenced assets46 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-22	22	Active Exploitation20Disclosure2
2026-09-23	29	Active Exploitation26General1Patch2
2026-09-24	12	Active Exploitation10Disclosure1Patch1
2026-09-25	7	Active Exploitation6Disclosure1
2026-09-26	2	Active Exploitation2
2026-09-27	2	Active Exploitation2
2026-09-29	2	Active Exploitation2
2026-09-30	1	Active Exploitation1
2026-10-01	2	Active Exploitation2
2026-10-08	1	Active Exploitation1
2026-10-11	1	Patch1
2026-10-23	1	Active Exploitation1
2026-10-24	1	Active Exploitation1
2026-10-26	1	Active Exploitation1
2026-10-28	1	Active Exploitation1

Full discourse20 posts

The Hacker News@TheHackersNews46d
Active Exploitation
‼️ WARNING - Attackers are actively exploiting a new CVSS 10.0 VeloCloud Orchestrator vulnerability. Only VCOs using certificate-based Edge authentication are exposed. Fixes for the 6.1 and 7.0 release trains are still pending. Learn more about CVE-2026-93952 here → https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html
Post summary
The tweet warns that CVE-2026-93952 (CVSS 10.0) in VeloCloud Orchestrator is currently under active exploitation, specifically targeting instances using certificate-based Edge authentication, while noting vendor fixes are still pending.
72221031942.0K
2.4M followersView on X
TRSiber | Siber Bilgi Ağı@trsiberyazilim43d
Active Exploitation
💢 Arista VeloCloud Orchestrator'da CVSS 10.0 puanlık sıfırıncı gün açığı CVE-2026-93952 aktif saldırılarda kullanılıyor. Kimlik bilgisi gerektirmeyen bu açık saldırganlara VCO üzerinde yönetici erişimi sağlıyor ve bağlı tüm SD-WAN Edge cihazlarını riske atıyor. CISA açığı KEV kataloğuna ekledi, federal kurumlara yama için yalnızca 3 gün (25 Eylül'e kadar) süre tanıdı. 5.2.x ve 6.4.x sürümü kullananların hemen güncelleme yapması gerekiyor. Detaylar 👇 https://www.trsiber.net/siber-dunya-haberleri/163-arista-velocloud-orchestrator-da-cvss-10-puanli-sifirinci-gun-cve-2026-93952-saldirilarda-cisa-uc-gun-sure-verdi #SiberGüvenlik #CVE #ZeroDay #Arista #SDWAN #SonDakika #Gündem
Post summary
The text reports CVE-2026-93952 (CVSS 10.0, auth-bypass RCE on Arista VeloCloud Orchestrator) is actively exploited in the wild, listed in CISA KEV, with an urgent patch required for versions 5.2.x and 6.4.x.
110310176
440 followersView on X
TRSiber | Siber Bilgi Ağı@trsiberyazilim45d
Active Exploitation
👉 VeloCloud Orchestrator'daki CVSS 10 puanlık CVE-2026-93952 açığı hâlâ tam kapatılmadı. Arista 5.2.3.16 ve 6.4.2.8'i yamaladı; 6.1 ve 7.0 için düzeltme henüz yok. Aktif istismar sürüyor, CISA 25 Eylül'e kadar süre tanıdı. #SiberGüvenlik #Arista #CVE #SonDakika #Gündem
Post summary
The text reports that CVE-2026-93952 in Arista VeloCloud Orchestrator is a CVSS 10 vulnerability that is actively exploited, with patches available for versions 5.2.3.16 and 6.4.2.8 but not yet for 6.1 and 7.0.
010320178
440 followersView on X
Dark Web Intelligence@DailyDarkWeb46d
Active Exploitation
🚨 CISA ADDS FOUR KNOWN EXPLOITED VULNERABILITIES — F5 BIG-IP APM CVE-2026-94127 LEADS CISA has updated the Known Exploited Vulnerabilities catalog (2026.09.22, 1721 entries) with four additions. The new lead for operators is F5 BIG-IP APM CVE-2026-94127, which was not previously covered on this channel. • CVE-2026-94127 — F5 BIG-IP APM heap-based buffer overflow • Actively exploited; federal BOD due date 2026-09-25 • Security reporting: unauthenticated RCE when an APM access policy and OAuth profile are on a virtual server (CVSS ~9.8) • Hotfixes available for 21.1.0 / 17.5.x / 17.1.x trains; temporary iRule mitigation until patched Also added (already covered earlier today — not rehashed as standalone posts): • CVE-2026-85102 / CVE-2026-93616 — Check Point • CVE-2026-93952 — Arista VeloCloud Orchestrator ⚠️ Analyst Note: Treat the F5 BIG-IP APM entry as urgent for environments with APM + OAuth on virtual servers. Apply F5’s temporary iRule mitigation where needed, then install the vendor hotfix. CISA alert: https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog F5 advisory: https://my.f5.com/manage/s/article/K000162605 CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog #DDW #DarkWeb #CISA #KEV #F5 #BIGIP #ThreatIntelligence #CyberSecurity
Post summary
CISA has added F5 BIG-IP APM CVE‑2026‑94127 to the Known Exploited Vulnerabilities catalog because it is being actively exploited in the wild. The vulnerability is a heap‑based buffer overflow that leads to unauthenticated remote code execution (CVSS ~9.8). Vendor hotfixes and a temporary iRule mitigation are available.
0111447.0K
209.0K followersView on X
Adam@seoscottsdale45d
Active Exploitation
1/4 Timeline, not rumor. Exploit landed before the catalog stamp. Sep 12 — Check Point Management exploitation in the wild (vendor) Sep 17 — Zyxel GS1900 CVE-2026-7273 exploitation observed Sep 21 — CISA KEV: CVE-2026-7273. Federal due Thu Sep 24 Sep 22 — CISA KEV four-pack, due Fri Sep 25: Arista VCO CVE-2026-93952 F5 APM CVE-2026-94127 Check Point Mgmt CVE-2026-93616 Check Point VPN/Gateway CVE-2026-85102 The catalog date is not day zero.
Post summary
The text reports active exploitation of multiple CVEs (including Check Point Management, Zyxel GS1900, etc.) observed in the wild and added to CISA KEV, with no mention of patches, PoCs, or exploit tools.
43041310
12.3K followersView on X
Netlas.io@Netlas_io46d
Active Exploitation
CVE-2026-93952: Improper Input Validation in VeloCloud Orchestrator, 10.0 Rating 🔥 A recently disclosed improper input validation vulnerability in on-premises VeloCloud Orchestrator (VCO) allows a remote attacker to access privileged internal functionality and impact the VCO host. This vulnerability is known to be actively exploited in the wild! 👉 https://nt.ls/Z9gGT
Post summary
CVE-2026-93952 is an improper input validation vulnerability in VeloCloud Orchestrator that has been disclosed and is currently being actively exploited in the wild.
03031592
7.8K followersView on X
CISO Marketplace@CisoMarketplace30d
Active Exploitation
Arista rolled out AI-driven Edge Threat Management for VeloCloud SD-WAN. Two months later, Network World reports a critical VCO flaw (CVE-2026-93952, CVSS 10.0) is being actively exploited — patched only on Hosted/Dedicated VCO and two on-prem trains. https://secureiotoffice.world/aristas-ai-driven-edge-threat-management-sd-wan-new-option/ #SDWAN #CVE
Post summary
The text explicitly reports CVE-2026-93952 with CVSS 10.0 as being actively exploited in the wild, with patching limited to specific VCO configurations, making active exploitation the core message.
1004083
378 followersView on X
RichTechGuy@richtechguy45d
Active Exploitation
Arista: actively exploited CVSS 10.0 on VeloCloud Orchestrator on-prem (CVE-2026-93952). Improper input validation → privileged internal functions; Edge cert auth path. Patch 5.2.3.16+ / 6.4.2.8+; CISA KEV due Sep 25. Lock down VCO UI, review IOCs. https://www.bleepingcomputer.com/news/security/arista-patches-actively-exploited-velocloud-orchestrator-zero-day/
Post summary
Arista reports CVE-2026-93952, a critical (CVSS 10.0) actively exploited zero‑day in VeloCloud Orchestrator, with patches 5.2.3.16+ and 6.4.2.8+ and a CISA KEV deadline; the advisory urges locking down the VCO UI and reviewing IOCs.
11020107
358 followersView on X
CyberSignal | Cybersecurity & AI News@XQOPTRX45d
Active Exploitation
🚨 CVSS 10.0 — ARISTA CONFIRMS ACTIVE EXPLOITATION OF VELOCLOUD ORCHESTRATOR Another critical infrastructure-management platform joins today's exploited-zero-day list. CVE-2026-93952 CVSS: 10.0 The vulnerability affects on-premises VeloCloud Orchestrator, used to centrally manage SD-WAN infrastructure. Remote attacker ↓ Improper input validation ↓ Privileged internal functionality reached ↓ Potential confidentiality + integrity + availability impact Arista says exploitation has already occurred in the wild. No normal tenant or operator credentials are required for the attack path described by the vendor. Patches are available for affected branches. CISA has also added the flaw to KEV. CyberSignal insight: Look at today's targets: F5 → access management Check Point → security management VeloCloud → network orchestration Attackers aren't just targeting endpoints. They're targeting the control plane. Sources: Arista · CISA · SecurityWeek #Cybersecurity #SDWAN #ZeroDay
Post summary
Tweet reports CVE-2026-93952 in Arista VeloCloud Orchestrator (CVSS 10.0) with confirmed in-the-wild exploitation per Arista and CISA KEV, patches available, and technical details on the improper input validation path leading to privileged functionality.
0103085
233 followersView on X
ExploitGrid@exploitgrid45d
Active Exploitation
🚨 CRITICAL | VeloCloud Orchestrator CVE-2026-93952 is a CVSS 10.0 vulnerability in on-prem VCO and is actively exploited. 🔓 No login required ⚠️ Affects certificate-based Edge authentication 🎯 Impact: VCO compromise
Post summary
The post reports a critical CVSS 10.0 vulnerability in VeloCloud Orchestrator that is being actively exploited, with details on required authentication and impact.
1102041
403 followersView on X
Daily CyberSecurity@Daily_CyberSec46d
Active Exploitation
An exploited VeloCloud vulnerability with a 10.0 CVSS score hits Arista appliances. Patch the critical VeloCloud vulnerability to stop active attacks. #VeloCloud #Arista #CVE202693952 #ZeroDay #Cybersecurity #Infosec https://securityonline.info/velocloud-vulnerability-cve-2026-93952/
Post summary
The text reports a critical VeloCloud vulnerability (CVE-202693952) with a CVSS 10.0 score that is being actively exploited in attacks against Arista appliances, urging immediate patching.
01030457
13.0K followersView on X
NotCVE@notCVE44d
Active Exploitation
⚠️ New in CISA KEV this week — exploited in the wild: • Arista VeloCloud Orchestrator… — CVSS 10 https://notcve.org/cve/CVE-2026-93952 • F5 BIG-IP APM Heap-based Buffer… — CVSS 9.8 https://notcve.org/cve/CVE-2026-94127 • Check Point Multiple Products… — CVSS 9.8 https://notcve.org/cve/CVE-2026-85102
Post summary
The tweet announces three CVEs newly added to the CISA KEV catalog, confirming they are actively exploited in the wild and providing high CVSS scores.
20001101
75 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker42d
Active Exploitation
【緊急】VeloCloudにCVSS 10.0、実悪用で更新と侵害確認を https://www.cybernote.click/2026/09/24/velocloud-cve-2026-93952-active-exploitation/ #IT #Security #cybersecurity
Post summary
The tweet warns of a critical VeloCloud vulnerability with CVSS 10.0 that is being actively exploited in the wild, urging users to apply updates and confirm breach.
0101046
209 followersView on X
Orion84@Orion84x44d
Active Exploitation
On-prem VeloCloud Orchestrator is under active exploit. CVSS 10 CVE-2026-93952 needs no operator login if Edge cert auth is on and the web UI is reachable.On-prem: 5.2.3.16 or 6.4.2.8. CISA due 25 Sep. Pull the UI off the internet #CyberSecurity #CVE Link: https://www.bleepingcomputer.com/news/security/arista-patches-actively-exploited-velocloud-orchestrator-zero-day/
Post summary
The text reports CVE-2026-93952 in the on-prem VeloCloud Orchestrator as actively exploited in the wild with a CVSS 10 score, provides technical details and affected versions, and references both a patch (via Arista) and a mitigation.
2000073
20 followersView on X
Diario฿itcoin@DiarioBitcoin45d
Active Exploitation
🚨 Arista urge parche para CVE-2026-93952 en VCO Vulnerabilidad crítica CVSS 10, explotada activamente. No requiere credenciales de inquilino u operador. Parches: 5.2.3.16 y 6.4.2.8. CISA la añadió al catálogo KEV. Revisar accesos y registros. https://t.co/hID05nN4Lv
Post summary
The tweet reports active exploitation of CVE-2026-93952 (CVSS 10.0) in Arista VCO, confirms CISA KEV listing, and urges immediate patching to fixed versions 5.2.3.16 and 6.4.2.8. Active exploitation takes precedence over patch availability as the primary classification.
10010559
213.4K followersView on X
Anthony Bahn@HoustonIntrove145d
Active Exploitation
I'd treat every on-prem VeloCloud Orchestrator as suspect until I see 5.2.3.16 or 6.4.2.8. CVE-2026-93952 is CVSS 10 and on KEV. No tenant login needed if Edge cert auth is on and the web UI is reachable. Pull admin reachability tonight, then dig for vc-sysmond.
Post summary
The text indicates CVE-2026-93952 is a CVSS‑10 vulnerability listed in the CISA KEV (actively exploited) and advises checking for patched versions (5.2.3.16 or 6.4.2.8) and exploiting conditions (no login needed under certain Edge cert auth settings). No PoC or named exploit tool is provided.
1001049
38 followersView on X
Orion84@Orion84x45d
Active Exploitation
Arista on-prem VeloCloud Orchestrator: CVSS 10.0, no login required, now on CISA KEV. CVE-2026-93952 can compromise the orchestrator and the SD-WAN data it manages. Hosted VCO is already patched. On-prem needs 5.2.3.16+ or 6.4.2.8. Due 25 Sep. Link: https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
Post summary
The post highlights CVE-2026-93952 in Arista on-prem VeloCloud Orchestrator with a CVSS 10.0, noting its presence on CISA KEV and providing specific patch versions for remediation.
2000040
21 followersView on X
NotCVE@notCVE46d
Active Exploitation
⚠️ ACTIVELY EXPLOITED — added to CISA KEV 2026-09-22 CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability CVSS 10 · EPSS 0.4% · 2 public exploits Details, versions & intel → https://notcve.org/cve/CVE-2026-93952 https://t.co/ogOesk5TYS
Post summary
The tweet confirms CVE-2026-93952 is actively exploited and added to CISA KEV as of 2026-09-22, with CVSS 10 and improper input validation in Arista VeloCloud Orchestrator. No specific exploit tool, PoC, or patch is named in the text.
1000181
74 followersView on X
Cybendium@cybendium14d
Active Exploitation
Troisième faille de VCO exploitée avant son correctif en quatre mois, après CVE-2026-16812 en juillet et CVE-2026-93952 en septembre. Une instance passée en 5.2.3.16 ou 6.4.2.8 en septembre reste vulnérable. Arista ajoute qu'aucun réglage ne ferme l'exposition. https://t.co/GnAWsDbfaQ
Post summary
The text reports active in-the-wild exploitation of a third Arista VCO vulnerability (CVE) before a patch was available, following two prior CVEs in July and September, and notes that upgrading to certain versions does not remediate the issue.
1000018
14 followersView on X
Anthony Bahn@HoustonIntrove137d
Active Exploitation
On-prem VeloCloud Orchestrator on the open internet trusts Edge cert material too far. CVE-2026-93952 (KEV, CVSS 10) turns that into unauth access to privileged internals, already exploited. Land 5.2.3.16 or 6.4.2.8 and lock the VCO UI to admin nets. https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
Post summary
CVE-2026-93952 in VeloCloud Orchestrator allows unauthenticated access, is already exploited (listed in KEV), and patches are available in versions 5.2.3.16 or 6.4.2.8 with a recommendation to restrict the UI to admin networks.
0100033
43 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	arista	velocloud_orchestrator	-	-	-

Explore more

Back to dashboard arista CVEs velocloud_orchestrator vulnerabilities

What researchers are saying

CVE-2026-93952

TRSiber | Siber Bilgi Ağı[verified]@trsiberyazilimActive Exploitation

The text reports CVE-2026-93952 (CVSS 10.0, auth-bypass RCE on Arista VeloCloud Orchestrator) is actively exploited in the wild, listed in CISA KEV, with an urgent patch required for versions 5.2.x and 6.4.x.

TRSiber | Siber Bilgi Ağı[verified]@trsiberyazilimActive Exploitation

The text reports that CVE-2026-93952 in Arista VeloCloud Orchestrator is a CVSS 10 vulnerability that is actively exploited, with patches available for versions 5.2.3.16 and 6.4.2.8 but not yet for 6.1 and 7.0.

Dark Web Intelligence[verified]@DailyDarkWebActive Exploitation

CISA has added F5 BIG-IP APM CVE‑2026‑94127 to the Known Exploited Vulnerabilities catalog because it is being actively exploited in the wild. The vulnerability is a heap‑based buffer overflow that leads to unauthenticated remote code execution (CVSS ~9.8). Vendor hotfixes and a temporary iRule mitigation are available.

Adam[verified]@seoscottsdaleActive Exploitation

The text reports active exploitation of multiple CVEs (including Check Point Management, Zyxel GS1900, etc.) observed in the wild and added to CISA KEV, with no mention of patches, PoCs, or exploit tools.

Netlas.io[verified]@Netlas_ioActive Exploitation

CVE-2026-93952 is an improper input validation vulnerability in VeloCloud Orchestrator that has been disclosed and is currently being actively exploited in the wild.

CISO Marketplace[verified]@CisoMarketplaceActive Exploitation

The text explicitly reports CVE-2026-93952 with CVSS 10.0 as being actively exploited in the wild, with patching limited to specific VCO configurations, making active exploitation the core message.

RichTechGuy[verified]@richtechguyActive Exploitation

Arista reports CVE-2026-93952, a critical (CVSS 10.0) actively exploited zero‑day in VeloCloud Orchestrator, with patches 5.2.3.16+ and 6.4.2.8+ and a CISA KEV deadline; the advisory urges locking down the VCO UI and reviewing IOCs.

Diario฿itcoin[verified]@DiarioBitcoinActive Exploitation

The tweet reports active exploitation of CVE-2026-93952 (CVSS 10.0) in Arista VCO, confirms CISA KEV listing, and urges immediate patching to fixed versions 5.2.3.16 and 6.4.2.8. Active exploitation takes precedence over patch availability as the primary classification.