Cybersecurity
Arista patches exploited VeloCloud Orchestrator flaw
Arista said attackers were exploiting a CVSS 10.0 flaw in on-premises VeloCloud Orchestrator deployments that use certificate-based Edge authentication, and it had released fixes for some supported versions.
- Arista said on 22 September that attackers were exploiting CVE-2026-93952 in on-premises VeloCloud Orchestrator.
- It said only orchestrators configured for certificate-based Edge authentication were exposed, and attackers also needed network access to the VCO web interface and the public part of an Edge certificate.
- Arista rated the flaw CVSS 3.1 10.0 and said a successful attack could compromise the orchestrator, its data and managed Edge devices.
- Fixed releases were available for the 5.2 and 6.4 trains, while 6.1 and 7.0 were still without fixes as of 22 September.
- Arista said the issue had been discovered externally and was known to be actively exploited, but it did not say when the attacks began or how widespread they were.
Arista said on 22 September that attackers were exploiting CVE-2026-93952 in on-premises VeloCloud Orchestrator installations. It said the software managed Edge devices in a VeloCloud SD-WAN.
The company said only deployments set up to use certificates for Edge authentication were exposed. It also said an attacker needed access to the VCO web interface and the public part of an Edge authentication certificate.
Arista gave the issue a CVSS 3.1 score of 10.0. It said a successful exploit could compromise the orchestrator, the data it handled and the Edge devices it managed.
As of 22 September, Arista said fixed releases were available for the 5.2 and 6.4 release trains, while fixes were still pending for 6.1 and 7.0. It said it had already patched the Hosted and Dedicated versions of VCO.
Arista said the flaw had been found outside the company and was already under active exploitation. It did not say when the attacks started or how many systems were affected, and it listed temporary steps and compromise checks for customers who could not upgrade immediately.
Named in this story
Companies
- Arista
- said the flaw was being exploited and published fixes and guidance
Organisations
- Technical Assistance Center (TAC)
- Arista support that customers on unsupported trains could contact
Products and systems
- VeloCloud Orchestrator
- the on-premises server affected by the flaw
- VeloCloud SD-WAN
- the network environment managed by VeloCloud Orchestrator
- VeloCloud Edge
- the devices managed and authenticated by the orchestrator
How the source tells it
A plain security advisory with no distinct emotive framing.
No emotive framing was found in the original.