Vulnerabilities · 4h ago
BleepingComputer reports Arista has released security updates for an actively exploited zero-day in VeloCloud Orchestrator (VCO) On-Prem, tracked as CVE-2026-93952.
The flaw lets a remote attacker reach privileged internal functions without the usual authorization boundary, potentially affecting the server running the orchestrator. That makes the host itself a concern; the reporting does not establish that attackers used it to alter managed networks.
If VCO controls network infrastructure in your environment, a host compromise could undermine confidence in the orchestration functions and systems it manages. A patched host alone would not establish whether those functions or systems were abused, and the source reports no evidence of downstream activity.
Known exploited · CISA KEV
CVSS 10 CRITICAL: veloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. EPSS 1% (63rd percentile).
CISA federal remediation date Sep 25 · date passed
2 sources covering this story
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting CVE-2026-114625 in VeloCloud Orchestrator, allowing logged-in users to gain full operator privileges.
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments.
Part of the PlainSec briefing for 2026-10-22