CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input Validation
Remote attackers can access privileged internal functionality in VeloCloud Orchestrator, compromising confidentiality, integrity, and availability.
- Exploited in the wild
- Since 22 Sep 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-93952?
CVE-2026-93952 is a critical missing authorization vulnerability in Arista Networks VeloCloud Orchestrator (VCO) On-Prem, published on 22 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Weakness: CWE-20
Which versions are affected by CVE-2026-93952?
It affects 1 product.
Products include Arista Velocloud Orchestrator.
How do I fix CVE-2026-93952?
No fix has been published for CVE-2026-93952 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 25 Sep 2026.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-93952 being exploited?
Yes. Attackers have exploited CVE-2026-93952 in the wild since at least 22 Sep 2026.
Other vulnerabilities in Arista Networks VeloCloud Orchestrator (VCO) On-Prem
Sources
Also known as GHSA-fqhw-f6hf-cq3w.