Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-93952

Published 2026-09-22

Updated last month

Vendor/s

Arista

Product/s

VeloCloud Orchestrator

Version/s

5.2.0 > 5.2.3.16

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

10

/ 10

Critical

Severity Details

Base score

10 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

Critical CVSS 10.0 vulnerability in Arista VeloCloud Orchestrator allows remote attackers to compromise SD-WAN management. Actively exploited.

## Why this matters

"CVE-2026-93952 is a critical vulnerability with a maximum CVSS score of 10.0, indicating the highest possible risk to affected organizations. As a KEV-listed vulnerability, it is currently being exploited in the wild. The flaw allows unauthenticated remote attackers to access privileged internal functionality within the VeloCloud Orchestrator (VCO). Because the orchestrator serves as the central management hub for SD-WAN environments, successful exploitation grants attackers full control over the network fabric, compromising the confidentiality and integrity of all managed data and edge devices."

## CPE

Arista

| Product                 | Version Start | Version End (excl.) | Status     |
| ----------------------- | ------------- | ------------------- | ---------- |
| velocloud\_orchestrator | 5.2.0         | 5.2.3.16            | vulnerable |
| velocloud\_orchestrator | 6.1.0         | 6.1.3.7             | vulnerable |
| velocloud\_orchestrator | 6.4.0         | 6.4.2.8             | vulnerable |
| velocloud\_orchestrator | 7.0.0         | 7.0.0.2             | vulnerable |

## Related weakness (CWE)

CWE-20

## Remediation plan

1

### Apply official patches

Immediately apply the security updates provided by Arista for on-premises VeloCloud Orchestrator (VCO) installations. Refer to Arista Security Advisory 0183 for specific patch files and installation procedures.

2

### Update affected systems

Ensure all VCO instances are running non-vulnerable versions. Upgrade to version 5.2.3.16, 6.4.2.8, or the latest patched releases for the 6.1.x and 7.0.x branches as specified in the vendor documentation.

3

### Restrict access

Implement strict network segmentation and firewall rules to isolate the VeloCloud Orchestrator management interface. Restrict access to known, trusted administrative IP addresses and disable public internet exposure where possible.

4

### Monitor for exploitation

Conduct forensic triage following CISA BOD 26-04 guidelines. Scan web server logs for unauthorized calls to internal API endpoints and monitor for suspicious administrative account creation or configuration changes.

## Detection Guidance

"Detecting exploitation of CVE-2026-93952 requires monitoring network traffic to the VCO management interface for unusual API requests. Security teams should inspect logs for unauthenticated access attempts to privileged internal functions. Look for indicators of compromise (IOCs) such as unexpected outbound connections from the VCO host, the presence of unauthorized administrative users, or modifications to SD-WAN routing policies that were not initiated by authorized personnel."

## References

[https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183 Mitigation Vendor Advisory ](https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-93952 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)