CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
Arista · VeloCloud Orchestrator
Vendor fix available · Affected: Arista VeloCloud Orchestrator · Exploitation: in CISA KEV since 22 Sep
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue22 Sep
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not established: not seen
Higher than 72% of scored CVEs
Federal deadline
CISA KEV · added 22 Sep · catalogue entry
Passed 41 days ago
DescriptionNVD
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
What changed
- CISA added it to the KEV catalogue CISA
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage6 articles · 4 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 22 Sep.
- Tue 22 Sep, 04:23 UTC. SecurityOnline, first report. Arista Warns Attackers Are Exploiting Critical VeloCloud Flaw. Cites a CVE in CISA KEV.
- Tue 22 Sep, 20:30 UTC. CISA, its first report on the story. CISA Warns of Active Attacks on Critical VeloCloud Flaw. Cites a CVE in CISA KEV.
- Wed 23 Sep, 08:47 UTC. SecurityWeek, its first report on the story. Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day. Cites a CVE in CISA KEV.
- Wed 23 Sep, 21:50 UTC. Security Affairs, its first report on the story. CISA Warns of Active Attacks on Check Point and F5 Flaws. Cites a CVE in CISA KEV.
- Thu 24 Sep, 03:36 UTC. SecurityOnline. Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk. Cites a CVE in CISA KEV.
- Fri 23 Oct, 10:59 UTC. SecurityWeek. Arista VeloCloud Flaw Marks Third Exploited Orchestrator Zero-Day. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 22 Sep 04:23 | SecurityOnline | Arista Warns Attackers Are Exploiting Critical VeloCloud Flaw |
| 22 Sep 20:30 | CISA | CISA Warns of Active Attacks on Critical VeloCloud Flaw |
| 23 Sep 08:47 | SecurityWeek | Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day |
| 23 Sep 21:50 | Security Affairs | CISA Warns of Active Attacks on Check Point and F5 Flaws |
| 24 Sep 03:36 | SecurityOnline | Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk |
| 23 Oct 10:59 | SecurityWeek | Arista VeloCloud Flaw Marks Third Exploited Orchestrator Zero-Day |
- Arista VeloCloud Flaw Marks Third Exploited Orchestrator Zero-DaySecurityWeek · mentions it in passing
- CISA Warns of Active Attacks on Check Point and F5 FlawsSecurity Affairs · mentions it in passing
- CISA Warns of Active Attacks on Critical VeloCloud FlawCISA · official notice
- Arista Warns Attackers Are Exploiting Critical VeloCloud FlawSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.