CVE-2026-93952 is an improper input validation issue in on-premises Arista VeloCloud Orchestrator that may let a remote attacker reach privileged internal functionality and impact the VCO host, compromising confidentiality, integrity and availability of the orchestrator and the SD-WAN data it manages; CISA added it to the KEV catalog the same day it was published.
Vulnerability summary
CVSS base score
10
Critical severity
EPSS score (FIRST)
1.1%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2026-93952 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Arista VeloCloud Orchestrator (VCO) On-Prem | cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* | 5.2.0 through 5.2.3.15 (fixed in 5.2.3.16); 6.1.0 through 6.1.3.7; 6.4.0 through 6.4.2.7 (fixed in 6.4.2.8); 7.0.0 through 7.0.0.2 — see vendor advisory for the exact fixed build on each branch. Hosted/Dedicated VCO was already patched. |
What does this mean for affected devices?
CVE-2026-93952 is an improper input validation vulnerability (CWE-20) in the on-premises deployment of Arista VeloCloud Orchestrator (VCO). NVD's description states the issue "may allow a remote attacker to access privileged internal functionality and impact the VCO host," and that "successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator"; it also notes that "Hosted, including Dedicated, versions of VCO were impacted and have already been patched" (NVD).
NVD lists the CVE as "Analyzed" and records Arista's own CVSS v3.1 submission of 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, scope changed, complete impact to confidentiality, integrity and availability (NVD).
CISA added CVE-2026-93952 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-22 — the same day NVD published the record — with a required-action due date of 2026-09-25, and flags forensic triage as required for affected assets (CISA KEV).
Arista's security advisory (SA0183) lists on-prem VCO 5.2.0 up to but excluding 5.2.3.16, 6.1.0 through 6.1.3.7, 6.4.0 up to but excluding 6.4.2.8, and 7.0.0 through 7.0.0.2 as affected per NVD's configuration data, and states that hosted and dedicated VCO instances were already remediated by Arista before disclosure (Arista Security Advisory 0183).
As of 2026-10-21, FIRST scores the probability of exploitation at 0.0106 (64.3th percentile) (FIRST EPSS).
Because on-prem VCO is an SD-WAN management plane with privileged access to the branch fleet it orchestrates, and CISA added this to KEV on day of publication, operators running an affected on-prem build should apply Arista's fix immediately and follow BOD 26-04 forensic-triage guidance for any internet-exposed orchestrator.
Evidence
- Improper input validation in on-prem Arista VeloCloud Orchestrator may let a remote attacker access privileged internal functionality and impact confidentiality, integrity and availability of the VCO host and its data; hosted/dedicated VCO was already patched. — NVD
- CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, per Arista's own CVSS submission as recorded by NVD (status: Analyzed). — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-22 (same day as publication), due date 2026-09-25, forensic triage required. — CISA KEV
- Affects on-prem VCO 5.2.0-5.2.3.15, 6.1.0-6.1.3.7, 6.4.0-6.4.2.7 and 7.0.0-7.0.0.2; hosted/dedicated VCO already remediated. — Arista Security Advisory 0183
- EPSS score is 0.0106 (64.3th percentile) as of 2026-10-21. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
Are hosted/Dedicated VeloCloud Orchestrator customers affected by CVE-2026-93952?
No — NVD's description notes that "Hosted, including Dedicated, versions of VCO were impacted and have already been patched"; only on-premises VCO deployments remain exposed (per NVD).
What can a remote attacker do if they exploit this flaw?
NVD states the issue "may allow a remote attacker to access privileged internal functionality and impact the VCO host," and that successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages (per NVD).
How quickly did CISA add this CVE to the KEV catalog?
CISA added CVE-2026-93952 to the Known Exploited Vulnerabilities catalog on 2026-09-22, the same day NVD published the record, with a required-action due date of 2026-09-25 and forensic triage flagged as required (per CISA KEV).
Which on-prem VCO versions are affected and fixed?
Affected branches are 5.2.0 through 5.2.3.15 (fixed in 5.2.3.16), 6.1.0 through 6.1.3.7, 6.4.0 through 6.4.2.7 (fixed in 6.4.2.8), and 7.0.0 through 7.0.0.2; Arista's advisory directs readers to confirm the exact fixed build on each branch (per Arista Security Advisory 0183).
What is the official CVSS score, and who submitted it?
NVD records Arista's own CVSS v3.1 submission of 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (per NVD).
Questions about this page?