Improper input validation in Arista Networks Velocloud Orchestrator (Vco) On-Prem
CVE-2026-93952
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- psirt@arista.com (vendor-advisory)
Frequently asked questions
- What is CVE-2026-93952?
- CVE-2026-93952 is a critical-severity vulnerability in Arista Networks Velocloud Orchestrator (Vco) On-Prem, classified under Improper Input Validation. CVSS score: 10.0/10. Published 2026-09-22.
- How severe is CVE-2026-93952?
- Critical severity. CVSS v3 base score is 10.0 out of 10.