Cybersecurity
Arista patches exploited VeloCloud Orchestrator flaw
Arista Networks said it fixed a zero-day in VeloCloud Orchestrator that attackers were already using, while CISA added the issue to its exploitation list and set a federal deadline.
- Arista Networks said it had issued patches for a zero-day in VeloCloud Orchestrator that was already being exploited.
- The flaw, tracked as CVE-2026-93952, affected VCO On-Prem deployments using certificate-based authentication between VeloCloud Edge and the orchestrator.
- Arista said remote attackers could reach privileged internal host functions without user interaction or credentials, although they still needed network access and the public part of the Edge certificate.
- CISA added CVE-2026-93952 to its Known Exploited Vulnerabilities catalogue and told U.S. federal civilian executive branch agencies to secure their networks by Friday, 25 September.
Arista said the vulnerability had been found outside the company and was known to be under active exploitation. It affected VCO deployments where certificate-based authentication from VeloCloud Edge to VeloCloud Orchestrator was enabled.
According to Arista, an attacker needed access to the VCO web interface and the public portion of the Edge certificate. The company said tenant or operator credentials were not required for that exposure.
Arista said hosted deployments on VCO 5.2.3.16 or later and VCO 6.4.2.8 or later had already been patched. It said more fixes would follow for VCO 6.1.3.7 and below, and 7.0.0.2 and below.
CISA added the issue to its Known Exploited Vulnerabilities catalogue on Tuesday and set a Friday deadline for U.S. federal civilian executive branch agencies. Arista told administrators to limit access to the web interface, check logs for suspicious activity, and preserve records if they suspected compromise.
Named in this story
Companies
- Arista Networks
- said it had patched the flaw and issued remediation advice
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- added the CVE to its exploitation catalogue and set a deadline
Products and systems
- VeloCloud Orchestrator
- the affected management platform
- VeloCloud Edge
- the edge product whose certificate was involved in the exposure
How the source tells it
The piece read like an incident advisory, with urgency coming from the active-exploitation warning and CISA’s deadline.
- urgency active-exploitation notice and a fixed remediation deadline
- threat highest-severity flaw and remote attack path