Arista patches critical CVSS 10.0 flaw in VeloCloud Orchestrator

Arista has identified and is addressing a critical vulnerability in the on-premises VeloCloud Orchestrator (VCO), designated as CVE-2026-93952. The flaw has received a maximum CVSS score of 10.0 and is reportedly being actively exploited in the wild.

The vulnerability allows a remote attacker with network access to execute privileged functions without requiring a login. This specific exploit targets VCO installations where Edge devices authenticate via certificates rather than activation codes or passwords. To exploit the flaw, an attacker needs network access to the orchestrator's web interface and the public portion of a valid Edge certificate.

Arista has released fixes for the 5.2 and 6.4 release branches. However, patches are not yet available for the 6.1 and 7.0 release branches. This marks the second CVSS 10.0 vulnerability discovered in the VeloCloud Orchestrator within a two-month period.