CVE Tools
Track your stack

New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

The Hacker NewsBy The Hacker News

Reported exploitedVeloCloud Orchestrator

Our summary

Arista Networks says attackers are actively exploiting CVE-2026-93952, a CVSS 10.0 vulnerability in on-premises VeloCloud Orchestrator deployments using certificate-based Edge authentication. A remote unauthenticated attacker with network access to the VCO web interface and an Edge certificate's public portion could access privileged internal functions, compromise the orchestrator, and potentially reach managed Edge devices. Fixed releases are available for 5.2 and 6.4, while fixes for affected 6.1 and 7.0 releases are pending; organizations should restrict VCO web access and monitor for signs of compromise.

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. BleepingComputerArista patches actively exploited VeloCloud Orchestrator zero-dayCVE-2026-16812, CVE-2026-93952
  2. Help Net SecurityAttackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instancesCVE-2026-93952
  3. SecurityWeekArista Urges Immediate Patching of Exploited VCO Zero-DayCVE-2026-93952
  4. SecurityWeekCritical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-DayCVE-2026-16812
  5. The Hacker NewsAttackers Exploit Arista VeloCloud Orchestrator Command Injection FlawCVE-2026-16812
  6. BleepingComputerArista patches VeloCloud Orchestrator zero-day exploited in attacksCVE-2026-16812

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store