Arista Warns of Exploited VeloCloud Orchestrator RCE
Tech GuruQuick Answer
CVE-2026-93952 is actively exploited, according to Arista and CISA KEV. Arista says hosted and dedicated VeloCloud Orchestrator services were patched; on-premises operators must select a supported fixed release or obtain branch-specific guidance where a fix is still unlisted.
Confirm Scope And Apply The Supported Fix
What to do now: Restrict VCO web access to trusted administrative networks, preserve investigation evidence and use the current vendor remediation table. Coordinate the update with incident response rather than treating patch installation as proof the host was not compromised.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | VeloCloud Orchestrator on-prem, hosted, and dedicated deployments in affected 5.2, 6.1, 6.4, and 7.0 release trains |
|---|---|
| Advisory | Security Advisory 0183 |
| CVE | CVE-2026-93952 |
| Authoritative release date | 2026-09-22 (Arista advisory publication; also the KEV addition day) |
| Authority revision date | 2026-09-23, Arista revision 1.1: CSAF JSON added. The former precise imported timestamps are not verified vendor publication/revision times. |
| Affected versions | On-prem VCO 5.2.3.15 and earlier, 6.1.3.7 and earlier, 6.4.2.7 and earlier, and 7.0.0.2 and earlier; Arista states that hosted and dedicated services were affected but patched. |
| Fixed version | VCO 5.2.3.16 or 6.4.2.8 where available; fixes for the other listed trains are pending, so follow Arista's current remediation table |
| CVSS base score | 10.0 (CVSS v3.1) / 9.5 (CVSS v4.0) |
| CVSS severity | Critical |
| Exploitation status | Known exploited: Arista reports active exploitation and CISA lists CVE-2026-93952 in KEV. Ransomware use is Unknown. This is positive exploitation evidence, not merely a severity-based inference. |
What Changed
The exposure described by Arista requires certificate-based Edge-to-VCO authentication, access to the public portion of an Edge authentication certificate and network access to the VCO web interface. Tenant/operator credentials are not required. CISA added the CVE on September 22 with a September 25 due date and forensic triage marked Yes.
What To Validate Now
- Inventory. Locate VeloCloud Orchestrator on-prem, hosted, and dedicated deployments in affected 5.2, 6.1, 6.4, and 7.0 release trains deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: On-prem VCO 5.2.3.15 and earlier, 6.1.3.7 and earlier, 6.4.2.7 and earlier, and 7.0.0.2 and earlier; Arista states that hosted and dedicated services were affected but patched. Do not infer applicability from product family or severity alone.
- Remediate. Use VCO 5.2.3.16 or later in its 5.2.3 train, or 6.4.2.8 or later in its 6.4.2 train. The checked table does not establish fixed 6.1 or 7.0 builds; contact Arista TAC for those upgrade paths rather than guessing a version.
- Validate. Read back the VCO build or obtain hosted-service remediation confirmation, then check normal orchestration and managed-device state. Record incident-response findings separately, including any recovery or credential decisions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Preserve web, backend, system and database logs before disruptive changes where feasible, and follow the advisory's current IOC and recovery guidance. No single indicator is definitive. Investigate suspicious activity even after updating; recovery may involve credential review and rebuilding affected instances. Covered agencies must also follow the KEV entry's exposure and forensic-triage requirements. Test the supported upgrade and rollback plan before broad deployment.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
