CVE-2026-93952

🎯 CVE-2026-93952 🔓 Exploited 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-93952 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Klassifikation & Betroffenheit:

CWE-20 Arista Networks VeloCloud Orchestrator (VCO) On-Prem 6.1.0 ≤6.1.3.7VeloCloud Orchestrator (VCO) On-Prem 5.2.0 ≤5.2.3.15VeloCloud Orchestrator (VCO) On-Prem 6.4.0 ≤6.4.2.7VeloCloud Orchestrator (VCO) On-Prem 7.0.0 ≤7.0.0.2

Improper Input Validation 🎯 High

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

🛡️ Empfohlene Mitigation: Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowi…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-10 · Buffer Overflow via Environment Variable… (High) CAPEC-13 · Subverting Environment Variable Values (Very High) CAPEC-101 · Server Side Include (SSI) Injection (High) CAPEC-104 · Cross Zone Scripting (High) CAPEC-108 · Command Line Execution through SQL Injec… (Very High) CAPEC-109 · Object Relational Mapping Injection (High) CAPEC-110 · SQL Injection through SOAP Parameter Tam… (Very High) CAPEC-120 · Double Encoding (Medium)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1562.003 · Impair Defenses:Impair Command His… T1574.006 · Hijack Execution Flow:Dynamic Link… T1574.007 · Hijack Execution Flow:Path Interce…

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-77554 10.0 CVE-2026-77537 10.0 CVE-2026-16812 10.0 CVE-2026-21858 10.0 CVE-2025-12285 10.0

🇩🇪 BSI-Sicherheitshinweise: BSI · hoch · Arista VeloCloud Orchestrator: Schwachstelle ermöglicht Umgehen von Si ↗

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

🔗 www.arista.com/en/support/advisories-notices/security-ad…

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 09/2026

Im KEV seit 09/2026

Heute 08.11.

CVSS-Vektor-Analyse: 9.5

AV · Angriffsvektor Netzwerk

AC · Komplexität Hoch

PR · Privilegien Keine

UI · Interaktion Keine

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CNA-Bewertung (Arista): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — weicht vom Dossier-Score ab

Veröffentlicht:22.09.2026

Aktualisiert:23.09.2026 03:55

Assigner (CNA):Arista

EUVD-ID:EUVD-2026-84296

EPSS-Verlauf (7 Messungen)

CWE-20 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	785	0,2 %
≥50 %	3.559	0,9 %
≥10 %	13.140	3,2 %
<10 %	396.069	95,8 %

Tier

CVEs

Anteil

≥90 %

785

0,2 %

≥50 %

3.559

0,9 %

≥10 %

13.140

3,2 %

<10 %

396.069

95,8 %

9.5 CRITICAL

EPSS

1.4%

CVE-2026-93952 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

Arista Networks

CVE-2026-93952 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

CWE-20 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 1 Monat ↻ vor 1 Monat

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub