CVE-2026-93952 · High · CISA KEV

Arista VeloCloud Orchestrator: Improper Input Validation Leads to Remote Compromise

Threat Engine Auto-Feed · data current as of 2026-09-23

CVE-2026-93952 in Arista VeloCloud Orchestrator (VCO) on-prem is an improper input validation vulnerability. It allows remote attackers to access privileged internal functionality, impacting the VCO host. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog.

  • CVSS:
  • EPSS percentile: 0.53212
  • Exploitation pressure: 57/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 53th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability stems from 'improper input validation,' meaning the software does not correctly check or sanitize data provided by users or other systems. This failure allows an attacker to submit malicious input that the system misinterprets, leading to unintended actions or access to restricted functions.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations utilizing Arista VeloCloud Orchestrator (VCO) on-prem deployments
  • Financial services sector, due to documented targeting by financially motivated groups like FIN7, LockBit affiliates, and APT38
  • Technology sector, due to documented targeting by state-sponsored and financially motivated groups like APT29 and Scattered Spider

Misconfigurations that escalate it

  • Lack of robust network segmentation for VeloCloud Orchestrator instances
  • Insufficient monitoring of VeloCloud Orchestrator logs for unusual access patterns or errors
  • Failure to apply vendor-recommended security configurations and hardening guidelines

High-impact scenarios

  • Remote attackers gaining access to privileged internal functionality on the VCO host, leading to full compromise of the orchestrator.
  • Compromise of confidentiality, integrity, and availability of data managed by the orchestrator, potentially impacting network configurations and sensitive operational data.
  • Potential for lateral movement within the network if the orchestrator is used as a pivot point, leading to broader system compromise.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor Arista VeloCloud Orchestrator logs for unusual access attempts to privileged internal functionality.
  • Implement network intrusion detection systems (NIDS) to identify anomalous traffic patterns originating from or directed at VCO instances.
  • Regularly audit VCO configurations for any unauthorized changes or deviations from baseline security policies.

Contain

  • Isolate affected Arista VeloCloud Orchestrator instances from the broader network if compromise is suspected.
  • Restrict network access to VCO instances to only necessary administrative interfaces and trusted sources.
  • Review and revoke any potentially compromised credentials associated with the VCO.

Patch

  • Apply the latest security patches and updates provided by Arista for VeloCloud Orchestrator on-prem deployments immediately.
  • Follow Arista's official advisories and upgrade paths to mitigate this improper input validation vulnerability.

Frontier verdict — High

This vulnerability is critical due to active exploitation in the wild (CISA KEV) and potential for full orchestrator compromise, demanding immediate patching.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.