Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Arista mitigation guidance for Arista VeloCloud Orchestrator compensating controls for CVE-2026-93952

Advisory/Mitigation
First reported
Last updated
Happening score
H score 53
2 unique sources, 2 articles

Summary

Hide ▲

Arista issued temporary mitigation steps for exposed VeloCloud Orchestrator (VCO) deployments while a fixed release is pending, limiting the risk from actively exploited CVE-2026-93952. The guidance applies to on-premises VCO systems that use certificate-based authentication and can be reached through the VCO web interface. Administrators are told to restrict access, monitor for malicious activity, and look for backdoor daemons or webshells on the host. The response also includes preserving logs and rotating credentials after remediation where practical.

Related Happenings

Arista security patch release for CVE-2026-93952

Security Patch Release
H score53 First: 22.09.2026 15:29 Last: 22.09.2026 15:29 Sources 1

How related: Arista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments.

About this happening: Arista released fixed VeloCloud Orchestrator (VCO) builds for the 5.2 and 6.4 trains, reducing exposure for deployments tied to CVE-2026-93952. The patch set cover...

Open Happening

VeloCloud Orchestrator certificate-based privilege escalation (CVE-2026-93952)

Vulnerability
H score49 First: 22.09.2026 15:29 Last: 22.09.2026 15:29 Sources 1

How related: Tracked as CVE-2026-93952, this maximum-severity flaw stems from an improper input validation weakness and affects VCO deployments where certificate-based authentication from the VeloCloud Edge to VeloCloud Orchestrator (VCO) is configured.

About this happening: CVE-2026-93952 is an actively exploited flaw in VeloCloud Orchestrator (VCO) that can let a remote attacker with no login access privilege internal functions and compr...

Open Happening

Cisco ISE and ISE-PIC actively exploited authentication bypass (CVE-2026-76460)

Vulnerability
H score51 First: 17.09.2026 10:20 Last: 17.09.2026 10:20 Sources 1

About this happening: Cisco ISE and Cisco ISE-PIC are facing CVE-2026-76460, a maximum-severity API authentication bypass that is actively exploited in the wild. The flaw lets remot...

Open Happening

Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog ordered federal agencies to patch systems against CVE-2026-76460 for within

Public Sector Action
H score37 First: 17.09.2026 10:20 Last: 17.09.2026 10:20 Sources 1

About this happening: CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to patch affected systems within three days after C...

Open Happening

CISA mitigation guidance for CISA Adds Cisco Secure FMC CVE-2026-20079 to KEV Sets Sept. 12 Deadline

Advisory/Mitigation
H score58 First: 10.09.2026 00:40 Last: 10.09.2026 00:40 Sources 1

About this happening: CISA added CVE-2026-20079 to the KEV catalog and gave Federal Civilian Executive Branch agencies a September 12, 2026 deadline to secure affected Cisco Secur...

Open Happening

Timeline

  1. 22.09.2026 15:29 3 articles · 13d ago

    Arista issues temporary mitigation steps for exposed VeloCloud Orchestrator deployments

    Mitigation Patch Update

    Arista said on September 22 that CVE-2026-93952 is actively exploited against on-premises VeloCloud Orchestrator deployments using certificate-based authentication and that fixed releases were still pending for some release trains. Until a fixed release is installed, the guidance tells administrators to limit access to the VCO web interface to trusted administrative networks, monitor for access from known malicious IP addresses and unexpected outbound traffic, consider blocking unnecessary outbound ports, watch for backdoor daemons and webshells, review recent administrator activity, preserve logs and system state if compromise is suspected, and rotate credentials after remediation.

    Show sources
    Open in new tab