CyberSecurity News

New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

The Hacker News

· September 22, 2026

AI summary

A vulnerability in VeloCloud Orchestrator is being actively exploited by attackers. The flaw affects on-premises VeloCloud Orchestrator servers that manage Edge devices in a VeloCloud SD-WAN. It may allow a remote attacker without login access to access internal functions and impact the VCO host. The issue specifically impacts VeloCloud Orchestrator setups that use certificates to authenticate Edge devices. Arista disclosed the flaw on September 22. The vulnerability is tracked as CVE-2026-93952 and has a CVSS score of 10.0.

Vulnerabilities mentioned

CVE-2026-93952

CRITICAL

CVSS 10

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Read the full article at The Hacker Newsthehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.