CVE-2026-93952: Arista VeloCloud Orchestrator Flaw (KEV)

CVE-2026-93952 is an improper input validation issue in on-premises Arista VeloCloud Orchestrator that may let a remote attacker reach privileged internal functionality and impact the VCO host, compromising confidentiality, integrity and availability of the orchestrator and the SD-WAN data it manages; CISA added it to the KEV catalog the same day it was published.

CVE-2026-93952 is an improper input validation vulnerability (CWE-20) in the on-premises deployment of Arista VeloCloud Orchestrator (VCO). NVD's description states the issue "may allow a remote attacker to access privileged internal functionality and impact the VCO host," and that "successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator"; it also notes that "Hosted, including Dedicated, versions of VCO were impacted and have already been patched" (NVD).

NVD lists the CVE as "Analyzed" and records Arista's own CVSS v3.1 submission of 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, scope changed, complete impact to confidentiality, integrity and availability (NVD).

CISA added CVE-2026-93952 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-22 — the same day NVD published the record — with a required-action due date of 2026-09-25, and flags forensic triage as required for affected assets (CISA KEV).

Arista's security advisory (SA0183) lists on-prem VCO 5.2.0 up to but excluding 5.2.3.16, 6.1.0 through 6.1.3.7, 6.4.0 up to but excluding 6.4.2.8, and 7.0.0 through 7.0.0.2 as affected per NVD's configuration data, and states that hosted and dedicated VCO instances were already remediated by Arista before disclosure (Arista Security Advisory 0183).

As of 2026-10-21, FIRST scores the probability of exploitation at 0.0106 (64.3th percentile) (FIRST EPSS).

Because on-prem VCO is an SD-WAN management plane with privileged access to the branch fleet it orchestrates, and CISA added this to KEV on day of publication, operators running an affected on-prem build should apply Arista's fix immediately and follow BOD 26-04 forensic-triage guidance for any internet-exposed orchestrator.

• Improper input validation in on-prem Arista VeloCloud Orchestrator may let a remote attacker access privileged internal functionality and impact confidentiality, integrity and availability of the VCO host and its data; hosted/dedicated VCO was already patched. — NVD
• CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, per Arista's own CVSS submission as recorded by NVD (status: Analyzed). — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-22 (same day as publication), due date 2026-09-25, forensic triage required. — CISA KEV
• Affects on-prem VCO 5.2.0-5.2.3.15, 6.1.0-6.1.3.7, 6.4.0-6.4.2.7 and 7.0.0-7.0.0.2; hosted/dedicated VCO already remediated. — Arista Security Advisory 0183
• EPSS score is 0.0106 (64.3th percentile) as of 2026-10-21. — FIRST EPSS