New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

A critical CVSS 10.0 vulnerability, CVE-2026-93952, in on-premises VeloCloud Orchestrator (VCO) is actively being exploited by attackers. The flaw allows unauthenticated remote attackers to escalate privileges and compromise the VCO host, but only affects deployments using certificate-based authentication from Edge devices to the orchestrator. Arista has released patches for the 5.2 and 6.4 release trains, but fixes for 6.1 and 7.0 are pending. Indicators of compromise include specific files, an MD5 hash, suspicious IPs, and an HTTP header in nginx logs. Organizations are advised to limit access to the VCO web interface, monitor for malicious activity, and apply patches as soon as available.

AI-extracted · verify before operational use