# CVE-2026-93952

Remote privilege escalation in VeloCloud Orchestrator (on‑prem).

- Page: https://www.vulneraibility.com/cve/CVE-2026-93952
- CVSS: 9.5
- Known exploited: yes, in CISA KEV since 2026-09-22; CISA due date 2026-09-25
- EPSS: 1.38% (percentile 72.3)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2026-09-22)
- Weakness: CWE-20
- Published: 2026-09-22

## Affected versions

- Arista Networks VeloCloud Orchestrator (VCO) On-Prem: affected >= 5.2.0 and <= 5.2.3.15; >= 6.1.0 and <= 6.1.3.7; >= 6.4.0 and <= 6.4.2.7; >= 7.0.0 and <= 7.0.0.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote attacker can access privileged internal functionality, compromise the VCO host and orchestrated data (confidentiality, integrity, availability).

## Action

Immediate action required

## Recommendation

Apply vendor patch immediately; isolate VCO, rotate creds, audit logs.

## References

- [advisory] https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.