Arista and VMware have confirmed active exploitation of CVE-2026-93952, a critical vulnerability in on-premises VeloCloud Orchestrator (VCO). The flaw allows a remote attacker with no login access to privilege internal functions and affect the VCO host. Only VCO deployments configured to authenticate Edge devices using certificates are affected. A CVSS score of 10.0 has been assigned. Patches have been released; organizations are urged to update immediately.

What should defenders do?

Apply the latest security patches released by Arista and VMware for VeloCloud Orchestrator immediately. If patching is not immediately possible, consider disabling certificate-based Edge authentication, noting this will impact Edge connectivity. Monitor Arista and VMware security advisories for further guidance.

criticalCVE

Actively Exploited Critical Flaw in VeloCloud Orchestrator (CVSS 10.0)

CVE-2026-93952 allows remote, unauthenticated compromise of on-premises VCO instances

CyberIntel DeskPublished 7 days agoUpdated less than a minute ago1 min read

Actively Exploited Critical Flaw in VeloCloud Orchestrator (CVSS 10.0)

Key Takeaways

CVE-2026-93952 is a CVSS 10.0 vulnerability in on-premises VeloCloud Orchestrator (VCO).
Active exploitation is confirmed; attackers can gain unauthenticated remote access.
Only VCO deployments using certificate-based Edge authentication are affected.
Patches have been released; immediate updating is strongly recommended.

Related Security News

highCVE

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

CISA Advisoriesabout 5 hours ago2 min read