Arista VeloCloud Orchestrator On-Prem flaw CVE-2026-93952 (CVSS 10) exploited; fixes for only some versions
Arista's on-prem VeloCloud Orchestrator has a maximum-severity input flaw (CVE-2026-93952) under attack. Fixed only in 5.2.3.16 and 6.4.2.8; 6.1 and 7.0 have no fix listed. Organisations should patch, restrict web access to admin networks and check logs.
Work-system issue: if your business runs on-prem VeloCloud Orchestrator, update to 5.2.3.16 or 6.4.2.8 or later. On 6.1 or 7.0, restrict the web interface to trusted admin networks and ask Arista TAC about a fix. Nothing for home users to do.
What’s happening
Arista disclosed CVE-2026-93952 on 22 September 2026. It is an improper input validation flaw in VeloCloud Orchestrator (VCO) On-Prem, the management server for Arista's VeloCloud SD-WAN networks. Arista says it was found externally and is known to be actively exploited, and CISA added it to its exploited-flaws list the same day. A remote attacker with no VCO login could reach privileged internal functions and affect the orchestrator host. Arista says exposure needs certificate-based authentication from VeloCloud Edge devices to be configured, plus network access to the VCO web interface and the public part of an Edge certificate. Hosted and dedicated VCO instances were affected but are already patched. For on-prem customers, fixes exist only for the 5.2.3 train (5.2.3.16) and the 6.4.2 train (6.4.2.8). The 6.1 train (6.1.3.7 and below) and the 7.0 train (7.0.0.2 and below) had no fix listed on the advisory when last checked, which says fixes for other trains will be added over time. Arista is separate from, and this is not the same as, its later VCO flaw CVE-2026-114625.
- What
- Flaw
- Affects
- Arista VeloCloud Orchestrator (VCO) On-Prem
- Affected
- VeloCloud Orchestrator On-Prem 5.2.3.15 and below
VeloCloud Orchestrator On-Prem 6.1.3.7 and below
VeloCloud Orchestrator On-Prem 6.4.2.7 and below
VeloCloud Orchestrator On-Prem 7.0.0.2 and below
Hosted and Dedicated VCO (already patched by Arista) - Fixed in
- 5.2.3.16 and later (5.2.3 train)
6.4.2.8 and later (6.4.2 train) - Since
- 22 Sept 2026
Timeline
- Update
Network World reported that 6.1.x (up to 6.1.3.7) and 7.0.x (up to 7.0.0.2) remained unpatched, and that a Qualys researcher thought the cause was most likely a request-forgery-style flaw. This is one analyst's view, not Arista's.
- Vendor revised
Arista revised the advisory to version 1.1, adding a CSAF machine-readable file. The advisory still says fixes for other release trains will be added over time.
- CISA added
CISA added CVE-2026-93952 to its Known Exploited Vulnerabilities catalog and ordered US federal civilian agencies to secure systems by 25 September.
- Made publicPartly fixed
Arista published Security Advisory 0183 for CVE-2026-93952 in VeloCloud Orchestrator On-Prem, rated CVSS 10.0 and stated to be actively exploited. Fixes were released for the 5.2.3 train (5.2.3.16) and 6.4.2 train (6.4.2.8); hosted and dedicated instances were already patched.
Sources
- Arista Security Advisory 0183Arista · 23 Sept 2026
- Arista patches actively exploited VeloCloud Orchestrator zero-dayBleepingComputer · 23 Sept 2026
- On-prem VeloCloud Orchestrator under attack, only some versions patchedNetwork World · 24 Sept 2026