Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Exploitation and remediation

• Exploitation evidence

  Confirmed in CISA KEV since Sep 22, 2026. Listed in CISA KEV and VulnCheck KEV.

• Patch and remediation

  Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA due date Sep 25, 2026.

• Safe detection guidance

  Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Sep 22, 2026 · Catalog

   Detected

   VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been p

2. Sep 22, 2026 · CISA KEV

   Known exploited

   Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

3. Sep 23, 2026 · Catalog

   Updated

   VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been p

4. Sep 25, 2026 · CISA KEV

   Remediation due

   Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

Affected

• cpe arista/velocloud orchestratorversion unspecified
• vendor Arista VeloCloud Orchestratorversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2026-93952

  Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

  cisa.gov
• CVE.orgVulnerability recordCVE-2026-93952

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-93952

  30-day exploitation probability 1.1%

  first.org
• NIST NVDVulnerability recordCVE-2026-93952

  VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator

  nvd.nist.gov
• VulnCheck KEVConfirmed exploitationCVE-2026-93952

  Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availab

  vulncheck.com

References

• CISA note · nvd.nist.gov
• CISA note · arista.com
• US Government Resource · cisa.gov
• CISA note · cisa.gov
• CISA note · cisa.gov
• VulnCheck exploitation evidence · cisa.gov