This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Arista fixes an actively exploited vulnerability
Arista fixes a critical, actively exploited vulnerability in VeloCloud Orchestrator (VCO) On-Prem, a solution for central management of SD-WAN infrastructure. So far, only the 5.2 (version 5.2.3.16) and 6.4 (version 6.4.2.8) trains have been fixed. Fixes for trains 6.1 and 7.0 have not been released yet. Arista had already fixed the hosted and dedicated VCO instances earlier [1].
An unauthenticated remote attacker can, due to insufficient input validation, access privileged internal functionality and take control of the VeloCloud Orchestrator host and subsequently of the managed VeloCloud Edge devices. Only deployments where VeloCloud Edge devices authenticate to the orchestrator with a certificate are vulnerable, and the attacker needs its public part. The vulnerability is already being actively exploited [1].
The vulnerability is present in product:
- VeloCloud Orchestrator; >=5.2.0, <5.2.3.16; >=6.1.0, <=6.1.3.7; >=6.4.0, <6.4.2.8; >=7.0.0, <=7.0.0.2
CVSS: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
More information:
- CVE-2026-93952 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 22. 9. 2026.
Links
By CESNET, z.s.p.o. Henrieta Paločková on 23. 9. 2026.