The vulnerability CVE-2026-93952 affects Arista Networks VeloCloud Orchestrator (VCO) On-Premises deployments. It is caused by improper input validation, which can be exploited remotely without authentication to gain access to privileged internal functions. Successful exploitation can lead to full compromise of the orchestrator's confidentiality, integrity, and availability. Multiple affected version ranges are identified, and hosted versions have already received patches. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability allows a remote attacker to access privileged internal functionality on the VCO host, leading to a complete compromise of the orchestrator and the data it manages. This includes full loss of confidentiality, integrity, and availability of the affected system.

Patches have been released for hosted and Dedicated versions of VCO. Users of the affected on-prem versions should apply the corresponding vendor patches as soon as possible. Since this is an on-premises product, remediation requires updating to fixed versions. Patch status is confirmed by the vendor advisory indicating hosted versions are patched; on-prem users should verify and apply official fixes accordingly.