CVE-2026-93952

Security Advisory 0183

Exploited in the wild. In CISA KEV since 2026‑09‑22. A vendor fix is available.

CVSS 3.110.0Critical EPSS percentile58th0.9% chance in 30 days CISA KEVListedsince 2026-09-22, due 2026-09-25
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-22Updated 2026-09-23Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run VeloCloud Orchestrator (VCO) On-Prem and identify its installed software version.
Upgrade the 5.2.3 release train to VCO 5.2.3.16 or later, or upgrade the 6.4 release train to VCO 6.4.2.8 or later.
Until the upgrade is complete, limit access to the VCO web interface to trusted administrator networks and investigate unexpected access attempts.

Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

In plain language

Written by AI from the record

This is a critical break-in flaw in unpatched VeloCloud Orchestrator (VCO) On-Prem systems that attackers are actively using, so act now.

Unauthenticated network access to privileged internal VeloCloud Orchestrator functionality enables full confidentiality, integrity, and availability compromise.

If you're affected

Administrative system takeover
Sensitive data exposure
Configuration tampering
Service disruption

What is it

A flaw in the management system can let an outsider reach powerful internal controls without being invited in. It is like someone finding an unlocked door directly into your business’s control room, where they could view information, change settings, or interrupt operations.

Who is affected

This matters to you if you run VeloCloud Orchestrator (VCO) On-Prem to manage network connections. It affects systems that have not received the vendor’s corrected software release, and an attacker does not need an account or employee assistance.

How urgent is it

Attackers are already exploiting this vulnerability. It is listed in CISA’s catalog of vulnerabilities known to be used in real attacks, with remediation due by September 25, 2026; treat this as an immediate priority.

What to do — in detail

Confirm the deployed VeloCloud Orchestrator version and whether its web interface is reachable from untrusted networks. Upgrade the 5.2.3 branch to 5.2.3.16 or later, or the 6.4 branch to 6.4.2.8 or later; review the vendor’s release notes and maintenance procedure before deployment. Hosted and Dedicated deployments were already patched according to the advisory, but confirm patch status with the service provider. If patching is delayed, restrict the web interface to trusted administrative networks and review VCO access records for unfamiliar source addresses or administrative activity. CISA’s KEV remediation due date is September 25, 2026; monitor for suspicious access attempts and unexpected configuration or data changes.

Technical context

CVSS v3.1 is 10.0 (Critical): AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The reported weakness is CWE-20 (Improper Input Validation), enabling remote unauthenticated access to privileged internal functionality and potential compromise of the orchestrator host and managed data. CISA added CVE-2026-93952 to KEV on 2026-09-22, and vendor reporting states it is actively exploited, including in certificate-based setups. No public exploit code is on record. No EPSS value or trend was provided.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS58th

CISA KEV

Listed as exploited in the wild since 2026-09-22.

US federal agencies must remediate by 2026-09-25.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.9% chance of exploitation activity in the next 30 days, which ranks it in the 58th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

24 events over 1 day, from the signal feeds we watch.

2026-09-23Patch availablepatch available, workaround available, workaround available, record updated, record updated
2026-09-22Added to CISA KEVpatch available, patch available, patch available, patch available, patch available, workaround available, workaround available, workaround available, workaround available, workaround available, published, weakness classified, att&ck mapped, record updated, record updated, record updated, record updated

Affected products

aristacommercial · US
- velocloud orchestratorOn-premNetworking Infrastructure / router-switch
Arista Networkscommercial · US
- VeloCloud Orchestrator (VCO) On-PremEmbeddedNetworking Infrastructure / router-switch

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable