Quick links
Press Enter to search, Esc to close
Exploited vulnerability
An improper input validation flaw (CWE-20) in Arista VeloCloud Orchestrator (VCO), the management server for VeloCloud SD-WAN.
In short
CVE-2026-93952 is an improper input validation flaw (CWE-20) in Arista VeloCloud Orchestrator (VCO), the management server for VeloCloud SD-WAN. Arista rates it 10.0 Critical on CVSS v3.1 and 9.5 on CVSS v4.0 in security advisory 0183 and says it is known to be actively exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 22 September 2026, the day of the advisory.
Arista rates the flaw 10.0 and says the issue "was discovered externally and is known to be actively exploited". The attacker needs network access to the VCO web interface and the public part of a VeloCloud Edge authentication certificate, but no VCO credentials. Arista says that the flaw may let a remote attacker reach privileged internal functionality and impact the VCO host. It does not name the attackers or say how many systems were hit.
There is one condition. Arista says the flaw applies when certificate-based authentication from VeloCloud Edge to the VCO is configured. If you use that setup, treat the orchestrator as exposed until it is updated. Hosted and Dedicated VCO were affected and were already patched when Arista published.
This is the second of three exploited VCO flaws since July 2026. The first is the CVE-2026-16812 OS command injection flaw, 57 days earlier. The third is the CVE-2026-114625 SQL injection flaw, 30 days later. The fixed builds here are newer than the July ones but older than the October ones. We compare all three side by side in 3 Exploited Arista VeloCloud Flaws in 88 Days.
What our X and dark web checks showed on 25 October 2026. X: 17 distinct posts name CVE-2026-93952, and 14 of them came on 22 and 23 September, right after the advisory and KEV entry of 22 September. Dark web monitoring through THANOS: 11 posts mention CVE-2026-93952 (Telegram 10, one forum), all on 22 and 23 September. These are aggregate counts, and we did not run or link any code.
Affected per Arista advisory 0183, by release train (when we read the advisory on 25 October 2026):
5.2.x through 5.2.3.15. Fixed in 5.2.3.16 and later.
6.1.x through 6.1.3.7. No fixed build listed.
6.4.x through 6.4.2.7. Fixed in 6.4.2.8 and later.
7.0.x through 7.0.0.2. No fixed build listed.
Arista says fixes for the other trains will be added over time. Check the advisory for 6.1 and 7.0 before you plan a change window.
The October flaw needs newer builds again: 5.2.3.18, 6.1.3.10 or 6.4.2.12. Aim for those, so one update covers this flaw and CVE-2026-114625.
Arista publishes security advisory 0183 for CVE-2026-93952 and says the issue was discovered externally and is known to be actively exploited.
CISA adds CVE-2026-93952 to its KEV catalog with a due date of 25 Sep 2026.
Arista advisory revision 1.1 adds a CSAF file.
Arista advisory 0199 (CVE-2026-114625) is published, 30 days after this one.
Find out whether certificate-based authentication from VeloCloud Edge to the VCO is configured. If it is, this flaw applies to you.
Compare your version with the affected list on this page. Anything up to 5.2.3.15, 6.1.3.7, 6.4.2.7 or 7.0.0.2 is affected.
Move to the build that also fixes CVE-2026-114625 in your train, rather than stopping at 5.2.3.16 or 6.4.2.8.
Arista advises limiting access to the VCO web interface to trusted administrative networks, since no credentials are needed to reach the flaw.
Arista advises monitoring for access from known malicious source IPs, for unexpected outbound traffic from the VCO host and for backdoor daemons and webshells. It also suggests blocking outbound ports that normal operation does not need.
Yes. Arista's advisory 0183 says the issue was discovered externally and is known to be actively exploited. It does not name the attackers.
CISA added it on 22 September 2026 with a due date of 25 September 2026. The entry's required action points to vendor mitigations and CISA's BOD 26-04 guidance.
5.2.3.16 and later in the 5.2 train and 6.4.2.8 and later in the 6.4 train. For 6.1 and 7.0 Arista lists no fixed build yet and says other trains will follow.
No. Arista says VCO tenant or operator credentials are not required. The attacker needs network access to the web interface and the public part of a VeloCloud Edge authentication certificate. This applies where certificate-based authentication from VeloCloud Edge to the VCO is configured.
No. They are separate flaws in advisories 0144 and 0199. See the CVE-2026-16812 page and the CVE-2026-114625 page.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
