Patches released for VeloCloud Orchestrator zero-day reported under active exploitation

VCO deployments using certificate-based authentication affected

BleepingComputer reports that Arista Networks issued security patches for CVE-2026-93952, an improper-input-validation vulnerability affecting VeloCloud Orchestrator On-Prem deployments configured for certificate-based authentication between VeloCloud Edge and VCO.

According to the report, an attacker with network access to the VCO web interface could access privileged internal VCO host functionality without target-system privileges or user interaction. Arista reportedly patched hosted deployments on VCO 5.2.3.16 or later and 6.4.2.8 or later, and plans patches for specified older versions.

Before the reported release, the newly disclosed flaw did not have these announced fixes for affected VeloCloud Orchestrator On-Prem deployments.

Arista has reportedly released or announced patches for CVE-2026-93952, while describing the maximum-severity VeloCloud Orchestrator flaw as under active exploitation. The report also says CISA added the CVE to its Known Exploited Vulnerabilities catalog.

Public certificate material and network reachability required

The reported change pairs patch availability with an allegation of active exploitation. The flaw is described as requiring neither VCO tenant nor operator credentials, although access to the public portion of an Edge authentication certificate and network access to the VCO web interface are reportedly required.