CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited

Arista said on September 22 that attackers are actively exploiting a new flaw, CVE-2026-93952 (CVSS 10.0), in on-premises VeloCloud Orchestrator (VCO), the server that manages Edge devices in a VeloCloud SD-WAN.

The flaw may allow a remote attacker with no login access to trigger privileged internal functions and affect the VCO host. Only orchestrators configured to authenticate their Edges using certificates are affected.