Description
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Published: 2026-09-22
Score: 9.5 Critical
EPSS: 1.1% Low
KEV: Yes
Impact: Remote Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an input validation weakness (CWE-20) that allows a remote attacker to access privileged internal functionality of VeloCloud Orchestrator. By exploiting this flaw the attacker can compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages.

Affected Systems

Arista Networks VeloCloud Orchestrator On‑Prem is affected, including all hosted and dedicated installations. The flaw already exists in earlier on‑prem builds and has been patched in newer releases; the recommended fix is to upgrade to VCO 5.2.3.16 or later in the 5.2.3 train, or to VCO 6.4.2.8 or later in the 6.4.2 train. Systems on unsupported release trains should contact TAC to discuss upgrade options.

Risk and Exploitability

The CVSS score of 9.5 reflects a high severity risk. The EPSS score of less than 1% indicates a low probability of exploitation, yet the vulnerability is listed in the CISA KEV catalog. The likely attack vector is the VCO web interface, implying a network‑based exploitation path. Although exploitation is currently rare, the potential to compromise the orchestrator and its data warrants immediate attention.

Generated by OpenCVE AI on September 22, 2026 at 21:54 UTC.

Remediation

Vendor Solution

The recommended resolution is to upgrade to a remediated VCO software version at your earliest convenience. These vulnerabilities have been fixed in the following releases: - VCO 5.2.3.16 and later in the 5.2.3 train - VCO 6.4.2.8 and later in the 6.4.2 train Releases in other release trains that fix this will be added over time. For VCOs not on a supported release train, customers can contact TAC to discuss possible upgrade options.

Vendor Workaround

Until fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment: - Restrict access to the VCO web interface to trusted administrative networks. - Monitor the VCO for accesses from known malicious source IPs. - Monitor for unexpected outbound network activity from the VCO host. - Consider blocking outbound ports not needed for normal activities. - Monitor for backdoor daemons and webshells. - Review recent administrator activity for unexpected changes.

OpenCVE Recommended Actions

  • Upgrade the VCO to version 5.2.3.16 or later in the 5.2.3 train, or to 6.4.2.8 or later in the 6.4.2 train.
  • If the orchestrator is on an unsupported release train, contact TAC for upgrade options.
  • Restrict access to the VCO web interface to trusted administrative networks.
  • Monitor the VCO for connections from known malicious IP addresses and for unexpected outbound traffic.
  • Block outbound ports that are not required for normal VCO operations.
  • Keep watch for backdoor daemons or webshells and review recent administrator activity for unexpected changes.

Generated by OpenCVE AI on September 22, 2026 at 21:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Arista
Arista velocloud Orchestrator
CPEs cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*
Vendors & Products Arista
Arista velocloud Orchestrator

Tue, 22 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Arista Networks
Arista Networks velocloud Orchestrator On-prem
Vendors & Products Arista Networks
Arista Networks velocloud Orchestrator On-prem
Metrics kev

{'dateAdded': '2026-09-22T00:00:00+00:00', 'dueDate': '2026-09-25T00:00:00+00:00'}

Tue, 22 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Description VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Title Security Advisory 0183
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.5, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Arista Velocloud Orchestrator
Arista Networks Velocloud Orchestrator On-prem
cve-icon MITRE

Status: PUBLISHED

Assigner: Arista

Published:

Updated: 2026-09-23T03:55:40.823Z

Reserved: 2026-09-19T01:37:47.225Z

Link: CVE-2026-93952

cve-icon Vulnrichment

Updated: 2026-09-22T13:14:01.833Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-22T08:16:43.047

Modified: 2026-09-23T14:32:12.417

Link: CVE-2026-93952

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T22:00:08Z

Weaknesses
  • CWE-20

    Improper Input Validation