New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-09-22 12:29 UTC
  • Importiert: 2026-09-28 17:42 UTC
  • CVSS: 10.0
  • Quelle-ID: thn_global
  • uid_hash: c3a00a4d6bcd1a6ea9ebf9887a9e84c8b2ff87e444ba443b38cd2246a33863ff

Inhalt

Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22.

The flaw, tracked as CVE-2026-93952, may allow a remote attacker with no login access to privilege internal functions and affect the VCO host. Only orchestrators set up to authenticate their Edges with certificates are

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2026-93952

CRITICAL

10

CRITICAL

10

2026-09-22

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
The Hacker News

thn_global

security_news - de https://feeds.feedburner.com/TheHackersNews