The vulnerability CVE-2026-93952 is an improper input validation flaw in Arista VeloCloud Orchestrator (VCO) on-premises versions prior to 5.2.3.16 and 6.4.2.8. It allows remote attackers with network access to the VCO web interface and access to the public portion of the VeloCloud Edge authentication certificate to bypass authentication and access privileged internal functions without tenant or operator credentials. This zero-day has been actively exploited in the wild. The flaw affects only on-premises VCO deployments where certificate-based authentication from VeloCloud Edge to VCO is configured. Arista has released urgent patches for affected versions and recommends immediate application. The vulnerability was added to CISA’s Known Exploited Vulnerabilities list, with federal agencies required to patch within three days.

Successful exploitation allows remote attackers to access privileged internal functionality of the VeloCloud Orchestrator, potentially compromising the confidentiality, integrity, and availability of the orchestrator and the data it manages. The flaw does not require valid tenant or operator credentials but does require network access to the VCO web interface and access to the public portion of the VeloCloud Edge authentication certificate. Deployments that restrict access to the VCO web interface have a reduced risk of exposure.

Arista has released official patches resolving this vulnerability in VCO versions 5.2.3.16 and 6.4.2.8 for the 5.2.x and 6.1.x release trains, respectively, with additional patches forthcoming for other trains. Immediate application of these patches is strongly recommended. Organizations should limit network access to the VCO web interface to reduce exposure risk. Arista advises reviewing VCO web access logs, backend application logs, and system logs for suspicious activity as no definitive indicators of compromise are currently known.