{"vulnerability": "CVE-2026-93952", "sightings": [{"uuid": "b93189c0-0d74-42d0-acfb-fc5e3ea127ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw3qipnnvk2t", "content": "CVE-2026-93952 - velocloud orchestrator (vco) on-prem\nThe on\u2011premises VeloCloud Orchestrator may let an attacker from outside reach privileged functions inside the system. This could let them view, change, or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#aristanetworks #CVE #infosec", "creation_timestamp": "2026-09-22T07:50:05.740750Z"}, {"uuid": "d59fabdf-96b9-49da-ade7-692d3ee3b682", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93952", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117313871866403815", "content": "CVE-2026-93952 (CRITICAL, CVSS 10) impacts Arista VeloCloud Orchestrator (On-Prem) via improper input validation. Remote, unauthenticated access may lead to full system compromise. Patch urgently. https://radar.offseq.com/threat/cve-2026-93952-cwe-20-improper-input-validation-in-arista-networks-velocloud-orchestrator-vco-on-prem-25dafe8f246f1077 #OffSeq #CVE #infosec #Vulnerability", "creation_timestamp": "2026-09-22T09:00:25.719455Z"}, {"uuid": "670ec92f-1e3c-4b37-8711-280060106b3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93952", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mw3ugjugqx2x", "content": "CVE-2026-93952 (CRITICAL) affects Arista VeloCloud Orchestrator (On-Prem). Remote exploit enables total system compromise. Update vulnerable versions ASAP. https://radar.offseq.com/threat/cve-2026-93952-cwe-20-improper-input-validation-in-arista-networks-velocloud-orchestrator-vco-on-prem-25dafe8...", "creation_timestamp": "2026-09-22T09:00:28.266661Z"}, {"uuid": "e1c199c4-9c51-41e7-a193-b375cbbf6dc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw3y62xxzp24", "content": "\ud83d\udea8 CVE-2026-93952 \u2014 CVSS 9.5 CRITICAL\n\nVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to a...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-93952\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-22T10:07:17.858496Z"}, {"uuid": "27524b50-764a-4a08-8755-c1f30bd3592e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mw4edsk3ni26", "content": "CVE-2026-93952 enables unauthenticated remote attackers to gain internal privileges on on-premises VeloCloud Orchestrator, potentially compromising orchestrator and managed Edge devices.\n", "creation_timestamp": "2026-09-22T13:45:16.663110Z"}, {"uuid": "8dbd3340-842a-463c-9cd3-353ff7eb532e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mw4eabsldf23", "content": "CVE-2026-93952 enables unauthenticated remote attackers to gain internal privileges on on-premises VeloCloud Orchestrator, potentially compromising orchestrator and managed Edge devices.\n", "creation_timestamp": "2026-09-22T13:43:17.857700Z"}, {"uuid": "3f040dea-e5e8-4857-8697-c35e2ec358e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mw4eeezabs22", "content": "CVE-2026-93952 enables unauthenticated remote attackers to gain internal privileges on on-premises VeloCloud Orchestrator, potentially compromising orchestrator and managed Edge devices.\n", "creation_timestamp": "2026-09-22T13:45:35.729398Z"}, {"uuid": "686fb5ba-91dd-4f3f-aa63-892227e1d271", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mw4fiseraa2l", "content": "Arista disclosed a critical flaw (CVE-2026-93952) in on-premises VeloCloud Orchestrator (VCO) actively exploited as of September 22. The vulnerability, with [\u2026]", "creation_timestamp": "2026-09-22T14:05:57.714965Z"}, {"uuid": "0878f34c-c2f4-4e3d-8d2c-5e357fd8ad6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mw4fst3dsa25", "content": "Arista Confirms: CVE-2026-93952 in VeloCloud Actively Exploited", "creation_timestamp": "2026-09-22T14:11:32.951989Z"}, {"uuid": "9e9075ae-8741-4290-9485-cbd918db6747", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mw4i6oq3qf2p", "content": "\ud83e\udd16 CVE-2026-93952 (CVSS 10.0): actively exploited flaw in on-prem VeloCloud Orchestrator gives unauthenticated remote attackers access to internal functions (certificate-based Edge auth setups).\nhttps://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html", "creation_timestamp": "2026-09-22T14:53:58.801558Z"}, {"uuid": "5237bb0e-d890-4d0f-afa9-150d0ed13629", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html", "content": "Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22.\n\nThe flaw, tracked as CVE-2026-93952, may allow a remote attacker with no login access to privilege internal functions and affect the VCO host. Only orchestrators set up to authenticate their Edges with certificates are", "creation_timestamp": "2026-09-22T16:00:43.362268Z"}, {"uuid": "240796be-be84-4082-893c-1010c0d342bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/arista-networks-security-advisory-av26-947", "content": "", "creation_timestamp": "2026-09-22T16:15:32.234080Z"}, {"uuid": "c953d9af-87a0-43b4-83db-e92a75b89c5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://infosec.exchange/ap/users/117064736050780246/statuses/117315207195568331", "content": "Arista disclosed active exploitation of CVE-2026-93952, a CVSS 10.0 unauthenticated flaw in on-prem VeloCloud Orchestrator with certificate authentication enabled. Compromise of the management plane risks full SD-WAN Edge control and lateral movement. Isolate exposed instances and hunt for abuse. #VeloCloud #ThreatIntel #InfoSec\nhttps://cyberworldops.eu/en/active-attacks-target-certificate-enabled-velocloud-orchestrator", "creation_timestamp": "2026-09-22T19:07:39.642184Z"}, {"uuid": "4dd3dfa2-d14f-4aba-a819-d3d5792801bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://infosec.exchange/users/cloud/statuses/117315260462773075", "content": "\ud83e\udd16 CVE-2026-93952 (CVSS 10.0): actively exploited flaw in on-prem VeloCloud Orchestrator lets unauthenticated remote attackers reach internal functions. Affects setups with certificate-based Edge auth (Arista, Sep 22).\n\ud83d\udd17 https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html#CVE #Exploit #CyberSec", "creation_timestamp": "2026-09-22T19:07:41.467003Z"}, {"uuid": "3254c815-b45d-4c31-991a-19b5fc7b243b", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/47b4bcc3-f667-4db7-8927-129085a9dcf6", "content": "", "creation_timestamp": "2026-09-22T20:00:03.294660Z"}, {"uuid": "918a3ae3-a616-4eb0-8df9-85c015690ccc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93952", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mw4zj5grct25", "content": "\ud83d\uded1 CVE-2026-93952\nArista VeloCloud Orchestrator\nCVSS 9.5 / EPSS 0% / KEV: No\nTL;DR: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue ma\u2026\nhttps://cvesentinel.com/report/CVE-2026-93952?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-22T20:04:04.809169Z"}, {"uuid": "373c413f-28a4-4293-b99e-5ef02ef348f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93952", "type": "seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/117317048129094181", "content": "Completing our tour of new known-exploited vulns today, here is Arista's perfect-10.\nhttps://ifin.network/t/arista-cve-2026-93952-auth-bypass-exploited-in-the-wild/856\n#ThreatIntel #ThreatIntelligence #IFIN", "creation_timestamp": "2026-09-22T22:28:24.082733Z"}]}