Loading story…
Arista Networks released urgent fixes for CVE-2026-93952, a CVSS 10.0 improper-input-validation flaw in on-premises VeloCloud Orchestrator (VCO) that has been exploited as a zero-day. An attacker with network access to the VCO web interface and the public portion of a VeloCloud Edge authentication certificate can reach privileged internal functionality without tenant or operator credentials, potentially compromising the confidentiality, integrity, and availability of the orchestrator and managed data. Affected versions include VCO 5.2.0–5.2.3.15, 6.1.0–6.1.3.7, 6.4.0–6.4.2.7, and 7.0.0–7.0.0.2; fixes are available in 5.2.3.16 and 6.4.2.8, with other release-train patches pending.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring U.S. federal agencies to remediate within three days. Administrators should apply Arista updates immediately and investigate VCO hosts for published indicators, including malicious files, a vc-sysmond implant, unauthorized systemd services, and suspicious source IPs in nginx logs. Rapid7 has proposed detection-only Metasploit modules to fingerprint potentially affected VCO interfaces and conduct local read-only IOC checks; the project cautions that a favicon can identify VCO but cannot reliably establish its version remotely, and exploitation also requires Edge-to-VCO certificate material.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-947 for CVE-2026-93952 in Arista VeloCloud Orchestrator On-Prem, reporting active exploitation. The notice identified affected releases across the 5.2, 6.1, 6.4, and 7.0 branches and advised administrators to apply relevant updates.
A draft Metasploit pull request proposed a detection-only HTTP scanner to fingerprint VeloCloud Orchestrator and assess affected version ranges, plus a read-only Linux post module to search for published exploitation indicators. The IOC module checks for malicious files, a vc-sysmond implant hash, the vc-sysmon.service unit, and attacker IP addresses in nginx logs.
CISA added CVE-2026-93952 to its Known Exploited Vulnerabilities catalog. Under BOD 26-04 guidance, U.S. federal agencies were given three days to remediate the flaw.
Arista disclosed CVE-2026-93952 as a CVSS 10.0 improper-input-validation flaw in on-premises VeloCloud Orchestrator that can permit access to privileged internal functionality when Edge-to-VCO certificate authentication is configured. It released fixed versions 5.2.3.16 and 6.4.2.8, while patches for other release trains remained pending.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcegithub.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Arista has disclosed and patched **CVE-2026-16812**, a maximum-severity OS command injection flaw in **VeloCloud Orchestrator (VCO) On-Prem** that is being actively exploited in the wild. The vulnerability lets a remote, unauthenticated attacker with network access to the VCO web interface reach privileged internal functionality that was intended only for internal use, potentially compromising the confidentiality, integrity, and availability of the orchestrator and the data it manages. The issue is tracked as **`CWE-78`** and carries a **CVSS 3.1** score reflecting complete impact across all three security pillars. Affected releases include **5.2.x before 5.2.3.14**, **6.1.x before 6.1.3.4**, **6.4.x before 6.4.2.4**, and **7.0.x before 7.0.0.1**. Arista said its **Hosted** and **Dedicated** VCO deployments were patched before public disclosure and are not affected, but warned that patching alone may not be enough if an instance was already compromised because attackers could also gain access to managed **VeloCloud Edge** devices. **CISA** has added the flaw to its **Known Exploited Vulnerabilities** catalog and directed U.S. federal civilian agencies to remediate it by **July 30, 2026**, while Arista has published indicators of compromise to support incident response.
Jul 29, 2026
CISA updated its Known Exploited Vulnerabilities catalog to add **CVE-2026-16812**, a critical `CVSS 10.0` OS command injection flaw in **Arista VeloCloud Orchestrator On-Prem**, and reporting also identified the addition of **CVE-2025-68686** in **Fortinet FortiOS**. The Arista issue can expose privileged internal functionality and allow remote compromise of the underlying orchestrator host, affecting the confidentiality, integrity, and availability of the platform and managed data. VMware and Arista said the VeloCloud vulnerability is being actively exploited in the wild. The Fortinet flaw is an information disclosure issue that can be abused by an attacker who already has filesystem-level access to bypass symbolic-link protections and continue accessing sensitive resources. CISA directed agencies to apply vendor mitigations and follow Binding Operational Directive requirements on accelerated timelines, while defenders were urged to identify exposed deployments, patch affected systems immediately, review logs for signs of compromise, and prioritize internet-facing management infrastructure tied to KEV-listed vulnerabilities.
Jul 29, 2026
Critical vulnerabilities were disclosed in **Ivanti Cloud Services Application (CSA)** and **VMware vCenter Server** products, exposing enterprise management platforms to remote compromise. Ivanti said CSA `5.0.2` and earlier contain three flaws—`CVE-2024-11639`, `CVE-2024-11772`, and `CVE-2024-11773`—that can enable authentication bypass, remote code execution, and arbitrary SQL query execution through the administrator browser console, with the most severe issues rated **CVSS 10.0**. Ivanti released fixes in CSA `5.0.3` and urged customers to update immediately. VMware also disclosed two vulnerabilities affecting **vCenter Server** and **VMware Cloud Foundation**: `CVE-2024-38812`, a heap overflow that can allow arbitrary code execution, and `CVE-2024-38813`, which can enable privilege escalation to root. The flaws affect vCenter Server `7.0` and `8.0` as well as VMware Cloud Foundation `4.x` and `5.x`, and can be exploited remotely over the network using specially crafted packets. In both vendor notices, no active exploitation had been confirmed at the time of disclosure, but organizations and service providers were advised to apply vendor-fixed versions without delay because successful attacks could result in full administrative compromise.
Jun 29, 2026